Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool
view advisory published 2025-04-24
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-26382US | — | — | ||
Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-25-114-05 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-25-114-05 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (2)
- MitigationICU
Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems.
- FixedICU
Johnson Controls recommends users upgrade ICU to Version 6.9.5 or greater.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan