Skip to content
OpenAdvisories
High · 8.7 CVE-2025-43876 EUVD-2025-205288GHSA-3vrr-x6c8-rfm2

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings

Published Dec 24, 2025 · Updated Dec 24, 2025 · Assigned by jci

Vendor: Johnson Controls Product: iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 Product: iSTAR Ultra, iSTAR Ultra SE Category: Browsers

Description

Under certain circumstances a successful exploitation could result in access to the device.

Affected products

VendorProductAffectedFixed
Johnson Controls iSTAR Ultra, iSTAR Ultra SE ≤ 6.9.7 —
Johnson Controls iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 ≤ 6.9.2 —

Advisories 1

References