Description
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Johnson Controls | iSTAR Ultra | ≤ 6.9.2 | — |
Advisories 1
- ICSA-25-224-02 Johnson Controls iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 (Update A) CISA ICS & IT advisories · Dec 16, 2025