Device Access Vulnerability in Johnson Controls Products
CVE-2025-43875
8.7HIGH
What is CVE-2025-43875?
A security misconfiguration vulnerability exists in Johnson Controls Smart Security Devices that could allow an unauthorized user to gain access to the device under specific conditions. This exploitation can lead to unauthorized control and potential data breaches, emphasizing the importance of implementing recommended security practices to mitigate any risk of unauthorized access.
Affected Version(s)
iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 0 <= 6.9.2
iSTAR Ultra, iSTAR Ultra SE 0 <= 6.9.7
References
CVSS V4
Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Johnson Controls reported these vulnerabilities to CISA.