Vulnerability in Johnson Controls iSTAR Ultra and Ultra SE Due to Missing Protection Mechanism

CVE-2025-53698

What is CVE-2025-53698?

A serious vulnerability has been identified in Johnson Controls iSTAR Ultra and iSTAR Ultra SE products, caused by a missing protection mechanism for an alternate hardware interface. This flaw can lead to functionality bypass, allowing unauthorized access or manipulation of the system. The affected versions prior to 6.9.2.CU02 are particularly vulnerable and should be promptly updated to mitigate risks. For more information on this and other security advisories, please visit the Johnson Controls cybersecurity resource.

References