Johnson Controls iSTAR Configuration Utility (ICU) tool
Successful exploitation of this vulnerability may allow an attacker to gain access to memory leaked from the ICU. This utility is only used to configure products that are no longer manufactured or supported. ICU is not used to configure the iSTAR Ultra and the current iSTAR G2 series of controllers. Furthermore, this vulnerability only impacts ICU and the Windows PC it is running on. This vulnerability does not impact iSTARs, including the legacy iSTARs.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-26383US | — | — | ||
The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on. | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-25-146-01 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-25-146-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (2)
- MitigationICU
For assistance and additional information, please contact Johnson Controls Trust Centertrustcenter@jci.com
https://www.johnsoncontrols.com/trust-center/cybersecurity - FixedICU
Johnson Controls recommends users update ICU to Version 6.9.5 or greater.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan