Skip to content
OpenAdvisories
High · 7.0 CVE-2025-53698 EUVD-2025-211328GHSA-vmj8-7r4m-rf88

Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultr…

Published Nov 13, 2026 · Assigned by jci

Vendor: Johnson Controls Product: iSTAR Ultra Product: iSTAR Ultra SE

Description

Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass.

This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02.

Affected products

VendorProductAffectedFixed
Johnson Controls iSTAR Ultra < 6.9.2.CU02 6.9.2.CU02
Johnson Controls iSTAR Ultra SE < 6.9.2.CU02 6.9.2.CU02

References