Default Credentials Vulnerability in Johnson Controls iSTAR Products
CVE-2025-53697

8.4HIGH

Key Information:

Vendor: Johnson Controls
Status: Istar Ultra; Istar Ultra Se; Istar Ultra G2; Istar Ultra G2 Se
Vendor: CVE Published:; 13 November 2026

🔔 Create Johnson Controls Vulnerability Alert

What is CVE-2025-53697?

A security flaw exists in several Johnson Controls iSTAR products due to the use of default credentials, which can be exploited to gain unauthorized access. Affected versions include iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, and Edge G2 prior to specified updates. It is crucial for users to change default credentials to enhance security and mitigate risks associated with unauthorized access.

Affected Version(s)

iSTAR Edge G2 0 < 6.9.2.CU02

iSTAR Ultra 0 < 2.9.2.CU02

iSTAR Ultra G2 0 < 6.9.2.CU02

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:

8.4

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 13, 2026
Vulnerability Reserved
Jul 8, 2025

CVE-2025-53697 Data

JSON