PT-2026-147180
CVE-2025-43874
·
Published
2026-11-13
·
Updated
2026-11-13
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Johnson Controls iSTAR Ultra versions prior to 6.9.2.CU02
Johnson Controls iSTAR Ultra SE versions prior to 6.9.2.CU02
Johnson Controls iSTAR Ultra G2 versions prior to 6.9.2.CU02
Johnson Controls iSTAR Ultra G2 SE versions prior to 6.9.2.CU02
Johnson Controls iSTAR Edge G2 versions prior to 6.9.2.CU02
Description
Improper neutralization of special elements used in an OS command allows for OS Command Injection. This occurs when an application fails to properly sanitize input used in system commands, enabling an attacker to execute arbitrary operating system commands on the host.
Recommendations
Update iSTAR Ultra to version 6.9.2.CU02 or later.
Update iSTAR Ultra SE to version 6.9.2.CU02 or later.
Update iSTAR Ultra G2 to version 6.9.2.CU02 or later.
Update iSTAR Ultra G2 SE to version 6.9.2.CU02 or later.
Update iSTAR Edge G2 to version 6.9.2.CU02 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾