Product Security Advisory

Overview

Johnson Controls has identified a set of previously undiscovered vulnerabilities affecting the following Software House door controller models:

• iSTAR Ultra
• iSTAR Ultra SE
• iSTAR Ultra G2
• iSTAR Ultra G2 SE
• iSTAR Edge G2

The identified vulnerabilities include:

• OS Command Injection
• Insufficient Verification of Data Authenticity
• Use of Default Credentials
• Mechanism for Alternate Hardware Interface - Physical Serial Access
• Mechanism for Alternate Hardware Interface - Physical USB Access
• Insecure Storage of Sensitive Information

Note: Johnson Controls made firmware version 6.9.3 available in 2024 to address CVE-2025-53695 and reduce the risk of exploitation for CVE-2025-53696, CVE-2025-53697, and CVE-2025-53700. The remaining two vulnerabilities require direct physical access to the controller.

CVE-2025-53695: OS Command Injection

Impact

This vulnerability impacts Software House iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 door controllers. Under certain circumstances, the web application may allow an authenticated attacker to gain privileged access ('root' user) to the device firmware.

Affected Versions

• iSTAR Ultra: versions 6.9.2.CU02 and prior
• iSTAR Ultra SE: versions 6.9.2.CU02 and prior
• iSTAR Ultra G2: versions 6.9.2.CU02 and prior
• iSTAR Ultra G2 SE: versions 6.9.2.CU02 and prior
• iSTAR Edge G2: versions 6.9.2.CU02 and prior

Mitigation

Upgrade affected iSTAR models to version 6.9.3 or higher. Johnson Controls strongly recommends disabling the web server on iSTAR after initial installation, following the hardening guide.

CVE-2025-53696: Insufficient Verification of Data Authenticity

Impact

This vulnerability affects iSTAR Ultra and iSTAR Ultra SE door controllers. While these versions perform firmware verification on boot, the verification does not inspect certain firmware portions. This can be exploited via OS command injection (as described in CVE-2025-53695) by an authenticated user.

Affected Versions

• iSTAR Ultra: versions 6.9.2.CU02 and prior
• iSTAR Ultra SE: versions 6.9.2.CU02 and prior

Mitigation

Update iSTAR Ultra and iSTAR Ultra SE door controllers to version 6.9.3 or higher. Disabling the web server on iSTAR after initial installation is also strongly recommended, per the hardening guide.

CVE-2025-53697: Use of Default Credentials / OS Command Access

Impact

This vulnerability affects Software House iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 door controllers. When an attacker can leverage command injection (CVE-2025-53695), it may be possible to utilize a default root password, which can be changed via the command shell.

Affected Versions

• iSTAR Ultra: versions 6.9.2.CU02 and prior
• iSTAR Ultra SE: versions 6.9.2.CU02 and prior
• iSTAR Ultra G2: versions 6.9.2.CU02 and prior
• iSTAR Ultra G2 SE: versions 6.9.2.CU02 and prior
• iSTAR Edge G2: versions 6.9.2.CU02 and prior

Mitigation

Update affected iSTAR models to version 6.9.3 or higher. Disabling the web server on iSTAR after initial installation is also strongly recommended, per the hardening guide.

CVE-2025-53698: Physical Serial Access

Impact

This vulnerability affects Software House iSTAR Ultra and iSTAR Ultra SE door controllers. If an attacker gains physical access, they may be able to access the iSTAR GCM (General Controller Module) serial console, providing access to Uboot.

Affected Versions

• iSTAR Ultra: all versions
• iSTAR Ultra SE: all versions

Mitigation

Ensure physical access to iSTAR Ultra and iSTAR Ultra SE door controllers is limited to authorized personnel. Install door controllers in locked enclosures with physical tamper switches, adhering to industrial standards and installation/hardening guides.

CVE-2025-53699: Physical USB Access

Impact

This vulnerability affects Software House iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 door controllers. If an attacker gains physical access, they may be able to access a USB console on the controller board.

Affected Versions

• iSTAR Ultra: all versions
• iSTAR Ultra SE: all versions
• iSTAR Ultra G2: all versions
• iSTAR Ultra G2 SE: all versions
• iSTAR Edge G2: all versions

Mitigation

Ensure physical access to iSTAR door controllers is limited to authorized personnel. Install door controllers in locked enclosures with physical tamper switches, adhering to industrial standards and installation/hardening guides.

CVE-2025-53700: Firmware Signing Key Access

Impact

This vulnerability affects Software House iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 door controllers (versions 6.9.2.CU02 and prior). By exploiting OS command injection (CVE-2025-53695), an authenticated user may access a firmware signing key used with other products.

Affected Versions

• iSTAR Ultra: versions 6.9.2.CU02 and prior
• iSTAR Ultra SE: versions 6.9.2.CU02 and prior
• iSTAR Ultra G2: versions 6.9.2.CU02 and prior
• iSTAR Ultra G2 SE: versions 6.9.2.CU02 and prior
• iSTAR Edge G2: versions 6.9.2.CU02 and prior

Mitigation

Update affected iSTAR models to version 6.9.3 or higher. Disabling the web server on iSTAR after initial installation is also strongly recommended, per the hardening guide.

Resources and Additional Guidance

For more information and detailed guidance, please refer to the following resources:

• Johnson Controls Cyber Solutions Website: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
• NIST National Vulnerability Database (NVD) and CVE: Links for specific CVEs are available in the original advisory.
• CISA ICS-CERT Advisories: Link for ICSA-25-224-02 is available in the original advisory.

In addition to the guidance provided in this advisory, Johnson Controls recommends applying the guidance within the Johnson Controls Hardening Guide to minimize security risk. Visit the Johnson Controls Trust Center Cybersecurity website for the latest hardening guidelines and best practices.