Skip to content
OpenAdvisories
High · 8.7 CVE-2025-43875 EUVD-2025-205289GHSA-frq8-587v-8qcr

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo

Published Dec 24, 2025 · Updated Dec 24, 2025 · Assigned by jci

Vendor: Johnson Controls Product: iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 Product: iSTAR Ultra, iSTAR Ultra SE Category: Browsers

Description

Under certain circumstances a successful exploitation could result in access to the device.

Affected products

VendorProductAffectedFixed
Johnson Controls iSTAR Ultra, iSTAR Ultra SE ≤ 6.9.7 —
Johnson Controls iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 ≤ 6.9.2 —

Advisories 1

References