Johnson Controls Software House iStar Door Controller (Update A)

Summary

Vulnerabilities 1

• High 8.8
  CVE-2024-32752

  Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

  The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access

  Johnson Controls iSTAR Configuration Utility (ICU) iSTAR Ultra and Ultra LT iSTAR Pro, Edge and eX Browsers
  Jun 6, 2024

Revision history

1. 2025-07-29 #2

   Update A - Added iStar Pro, Edge, eX, Ultra and Ultra LT to affected products and mitigation sections.

2. 2024-06-06 #1

   Initial Publication

References

• ICSA Advisory ICSA-24-158-04 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-04
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014