CVE-2025-53698

Received Received - Intake

Missing Protection Mechanism in Johnson Controls iSTAR Ultra and iSTAR Ultra SE

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Johnson Controls

Description

Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-13

Last Modified

2026-11-13

Generated

2026-11-14

AI Q&A

2026-11-14

EPSS Evaluated

N/A

NVD

CVE-2025-53698

Affected Vendors & Products

Vendor	Product	Version / Range
johnson_controls	istar_ultra	to 6.9.2.CU02 (exc)
johnson_controls	istar_ultra_se	to 6.9.2.CU02 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1299	The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers and other external facing unguarded interfaces) allows an attacker to bypass existing protections to the asset that are only performed against the primary path.

Attack-Flow Graph

Executive Summary

This vulnerability involves a missing protection mechanism for an alternate hardware interface in Johnson Controls iSTAR Ultra and iSTAR Ultra SE devices. It allows attackers to bypass intended functionality using CAPEC-554, which is a known attack pattern for bypassing security controls.

Impact Analysis

An attacker could exploit this to bypass security controls on affected devices, potentially gaining unauthorized access or disrupting operations. This could lead to physical security breaches or system malfunctions in environments using these devices.

Compliance Impact

This vulnerability could lead to non-compliance with regulations requiring physical or system security controls, such as GDPR (data protection) or HIPAA (healthcare data security), if it results in unauthorized access or data breaches.

Mitigation Strategies

Update iSTAR Ultra and iSTAR Ultra SE to version 6.9.2.CU02 or later to address the missing protection mechanism vulnerability.

Hi! I’m here to help you understand CVE-2025-53698. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...