by Kastro
Paper/Archive/CVE-2025-53695

CVE-2025-53695

Johnson Controls, Inc iSTAR Ultra — OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root'…

EPSS 0.9%CVSS 9.4
critical.is priorityof 100
40
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 59.2.592 × 2011.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.

Affected

ProductAffectedFixed inSource
iSTAR Ultra≤ 6.9.2–CNA

Scores by source

Dragos (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refraw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-03.txt