Alternate Hardware Interface Vulnerability in Johnson Controls iSTAR Products
CVE-2025-53699

7HIGH

Key Information:

Vendor

Johnson Controls

Status
Istar Ultra
Istar Ultra Se
Istar Ultra G2
Istar Ultra G2 Se
Vendor
CVE Published:
13 November 2026

What is CVE-2025-53699?

The alternate hardware interface vulnerability in Johnson Controls' iSTAR Ultra products arises from a missing protection mechanism which allows unauthorized access and potential functionality bypass through exploit techniques outlined in CAPEC-554. This affects several models, including iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, and Edge G2, prior to the version 6.9.2.CU02. Users are advised to review the necessary security advisories and update their systems to mitigate potential risks.

Affected Version(s)

iSTAR Edge G2 0 < 6.9.2.CU02

iSTAR Ultra 0 < 6.9.2.CU02

iSTAR Ultra G2 0 < 6.9.2.CU02

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.