CVE-2023-3127

criticalPriorität · verfolgen · 39EPSS 0.006 · 47. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.56% (47th) EPSS

CVSS 9.8 · critical

Is it mine?

20 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-29

An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobeniSTAR Edge G2cisa_csaf_ot
Johnson Controls recommends that users upgrade Sensormatic Elctronics iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 firmware to version 6.9.2 CUO1.
BehobeniSTAR Ultracisa_csaf_ot
Johnson Controls recommends that users upgrade Sensormatic Elctronics iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 firmware to version 6.9.2 CUO1.
BehobeniSTAR Ultra G2cisa_csaf_ot
Johnson Controls recommends that users upgrade Sensormatic Elctronics iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 firmware to version 6.9.2 CUO1.
BehobeniSTAR Ultra LTcisa_csaf_ot
Johnson Controls recommends that users upgrade Sensormatic Elctronics iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 firmware to version 6.9.2 CUO1.
MitigationiSTAR Edge G2cisa_csaf_ot
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2023-05.
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
MitigationiSTAR Ultracisa_csaf_ot
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2023-05.
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
MitigationiSTAR Ultra G2cisa_csaf_ot
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2023-05.
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
MitigationiSTAR Ultra LTcisa_csaf_ot
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2023-05.
https://www.johnsoncontrols.com/cyber-solutions/security-advisories

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.07.5highCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Lsecondary · CISA US

v3.17.5highCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Lsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Lsecondary · productsecurity@jci.comAusnutzbarkeit 1.6 · Auswirkung 5.3

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-287USprimärCWE-287US

betroffene Produkte (20)

Betroffene Produkte und Versionsbereiche.

iSTAR Edge G2: < 6.9.2 CU01alle Versionencisa_csaf_otUS
iSTAR Ultra G2: < 6.9.2 CU01alle Versionencisa_csaf_otUS
iSTAR Ultra LT: > 6.8.6 | < 6.9.2 CU01alle Versionencisa_csaf_otUS
iSTAR Ultra: > 6.8.6 | < 6.9.2 CU01alle Versionencisa_csaf_otUS
Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc. iSTAR Edge G2< 6.9.2 CU01cisa_csaf_otUS
Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc. iSTAR Ultra6.8.6 | → 6.9.2 CU01cisa_csaf_otUS
Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc. iSTAR Ultra G2< 6.9.2 CU01cisa_csaf_otUS
Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc. iSTAR Ultra LT6.8.6 | → 6.9.2 CU01cisa_csaf_otUS
Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. iSTAR Edge G20 → 6.9.2 CU01enisa_euvdEU
Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. iSTAR Ultra>6.8.6 → 6.9.2 CU01enisa_euvdEU
Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. iSTAR Ultra G20 → 6.9.2 CU01enisa_euvdEU
Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. iSTAR Ultra LT>6.8.6 → 6.9.2 CU01enisa_euvdEU
johnsoncontrols edge g2 firmware< 6.9.2nvdUScpe:2.3:o:johnsoncontrols:edge_g2_firmware:*:*:*:*:*:*:*:*
johnsoncontrols edge g2 firmware= 6.9.2nvdUScpe:2.3:o:johnsoncontrols:edge_g2_firmware:*:*:*:*:*:*:*:*
johnsoncontrols istar ultra firmware6.8.6 → 6.9.2nvdUScpe:2.3:o:johnsoncontrols:istar_ultra_firmware:*:*:*:*:*:*:*:*
johnsoncontrols istar ultra firmware= 6.9.2nvdUScpe:2.3:o:johnsoncontrols:istar_ultra_firmware:*:*:*:*:*:*:*:*
johnsoncontrols istar ultra g2 firmware< 6.9.2nvdUScpe:2.3:o:johnsoncontrols:istar_ultra_g2_firmware:*:*:*:*:*:*:*:*
johnsoncontrols istar ultra g2 firmware= 6.9.2nvdUScpe:2.3:o:johnsoncontrols:istar_ultra_g2_firmware:*:*:*:*:*:*:*:*
johnsoncontrols istar ultra lt firmware6.8.6 → 6.9.2nvdUScpe:2.3:o:johnsoncontrols:istar_ultra_lt_firmware:*:*:*:*:*:*:*:*
johnsoncontrols istar ultra lt firmware= 6.9.2nvdUScpe:2.3:o:johnsoncontrols:istar_ultra_lt_firmware:*:*:*:*:*:*:*:*

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-23-192-02Sensormatic Electronics iSTAR2023-07-11icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an unauthenticated user to login to iSTAR devices with administrator rights.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

veröffentlicht 2023-07-11geändert 2026-06-17

verwandt (7,744)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-105133US	high7.3OT kritisch	79.5% (100th)	KEV	2026-10-04
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component…
CVE-2026-82329US	—OT kritisch	14.4% (97th)	KEV	2026-08-28
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileg…
CVE-2026-42018US	—OT kritisch	9.80% (96th)	KEV	2026-08-12
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVE-2026-65400US	—OT kritisch	1.72% (77th)	KEV	2026-08-06
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, ma…
CVE-2026-16232US	critical9.8OT kritisch	3.52% (89th)	KEV	2026-07-22
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to au…

+7739 weitere

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan