OS Command Injection Vulnerability in Johnson Controls iSTAR Products
CVE-2025-43874

8.7HIGH

Key Information:

Vendor

Johnson Controls

Status
Istar Ultra
Istar Ultra Se
Istar Ultra G2
Istar Ultra G2 Se
Vendor
CVE Published:
13 November 2026

What is CVE-2025-43874?

An OS Command Injection vulnerability has been identified in several Johnson Controls iSTAR products, including iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2. This vulnerability arises from the improper neutralization of special elements in input data, potentially allowing malicious users to execute arbitrary operating system commands. Affected versions of these devices are those prior to 6.9.2.CU02. It is crucial for users to secure their systems by updating to the latest firmware in order to mitigate this risk.

Affected Version(s)

iSTAR Ultra 0 < 6.9.2.CU02

iSTAR Edge G2 0 < 6.9.2.CU02

iSTAR Ultra G2 0 < 6.9.2.CU02

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.