Johnson Controls iSTAR Ultra and Edge OS Command Injection Vulnerability Allowing Full Device Access

A command injection vulnerability has been identified in Johnson Controls iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 door controllers, all versions prior to the latest release. This vulnerability could be exploited to modify firmware and gain complete control over the affected device.

Impact

Exploitation of this vulnerability could lead to unauthorized firmware modifications and full access to the device.

Remediation

Users are advised to upgrade iSTAR Ultra, iSTAR Ultra SE, and iSTAR Ultra LT to version 6.9.7.CU01 or greater. For iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2, upgrade to version 6.9.3 or greater. For detailed mitigation instructions, refer to the Johnson Controls Product Security Advisory JCI-PSA-2025-11 and JCI-PSA-2025-13.