Johnson Controls iSTAR Products Command Injection Vulnerability Allowing Unauthorized Device Access

A command injection vulnerability has been identified in Johnson Controls iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2. This vulnerability, present in versions prior to 6.9.7.CU01 for iSTAR Ultra and iSTAR Ultra SE, and prior to 6.9.3 for iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2, could be exploited under certain circumstances to gain unauthorized access to the affected device.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the device.

Remediation

Users are advised to upgrade iSTAR Ultra and iSTAR Ultra SE to version 6.9.7.CU01 or greater, and iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 to version 6.9.3 or greater. For detailed mitigation instructions, refer to the Johnson Controls Product Security Advisories JCI-PSA-2025-14 and JCI-PSA-2025-15.