Johnson Controls iSTAR Ultra OS Command Injection Vulnerability Granting Root Access

An OS command injection vulnerability has been identified in the web application of Johnson Controls iSTAR Ultra products, including iSTAR Ultra SE and iSTAR Ultra G2. This vulnerability allows an authenticated attacker to execute commands on the device's operating system with 'root' privileges, potentially leading to unauthorized access or manipulation of the device firmware. The issue has been tested and confirmed on iSTAR Ultra firmware versions through 6.9.2, with later versions possibly also affected.

Impact

Exploitation of this vulnerability allows for authenticated command injection via HTTP, with injected OS commands executed as the 'root' user on the device.