CVE-2025-53698
mediumpriority · track · 0OT risk · elevatedUSNo description recorded.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixediSTAR Ultracisa_csaf_ot
According to Johnson Controls, the iSTAR Ultra is an older device that has a planned end of service date within a year from this publication. Johnson Controls recommends users consider upgrading to a newer control unit. The hardware installation manual for iSTAR Ultra requires all control units be installed in a restricted access, protected area to lower the risk of physical tampering.
- MitigationiSTAR Ultracisa_csaf_ot
Dragos recommends end users place the following network restrictions around iSTAR controllers, regardless of model or firmware version:
- MitigationiSTAR Ultra SEcisa_csaf_ot
Dragos recommends end users place the following network restrictions around iSTAR controllers, regardless of model or firmware version:
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-25-224-02Johnson Controls iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 (Update A)2025-08-12icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow an attacker to modify firmware and access the space that is protected by the device.
sources
Which sources assert this record, and when.
references
External citations — patches, advisories, analysis.
No references recorded.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan