Critical · 10.0 CVE-2022-21941 EUVD-2022-27097GHSA-c8hm-v577-p7v7

iSTAR Ultra

Published Aug 31, 2022 · Updated Sep 17, 2024 · Assigned by jci

Vendor: Johnson Controls Product: iSTAR Ultra

Description

All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.

Affected products

Vendor	Product	Affected	Fixed
Johnson Controls	iSTAR Ultra	all versions prior to 6.8.9.CU01 – < 6.8.9.CU01	6.8.9.CU01

Advisories 1

ICSA-22-242-11 Sensormatic Electronics iSTAR CISA ICS & IT advisories · Aug 30, 2022

References

https://www.johnsoncontrols.com/cyber-solutions/security-advisories
ICS-CERT Advisory third-party-advisory