iSTAR Ultra: Use of Default Credentials
CVE-2025-53697 is a high-severity use of default credentials vulnerability in iSTAR Ultra from Johnson Controls, with a CVSS 4.0 base score of 8.4 out of 10. It can be exploited with local access to the system by an attacker with administrator privileges, without any action from a user. The record lists version 2.9.2.CU02 as the first without the flaw, so updating iSTAR Ultra to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update iSTAR Ultra to 2.9.2.CU02 or a later version.
- Update iSTAR Ultra SE to 6.9.2.CU02 or a later version.
- Update iSTAR Ultra G2 to 6.9.2.CU02 or a later version.
- Read the advisory on johnsoncontrols.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Johnson Controls | iSTAR Ultra | before 2.9.2.CU02 | 2.9.2.CU02 |
| Johnson Controls | iSTAR Ultra SE | before 6.9.2.CU02 | 6.9.2.CU02 |
| Johnson Controls | iSTAR Ultra G2 | before 6.9.2.CU02 | 6.9.2.CU02 |
| Johnson Controls | iSTAR Ultra G2 SE | before 6.9.2.CU02 | 6.9.2.CU02 |
| Johnson Controls | iSTAR Edge G2 | before 6.9.2.CU02 | 6.9.2.CU02 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- NoneThe attack does not depend on a particular deployment or configuration.
- Privileges required
- HighAdministrator-level access is required first.
- User interaction
- NoneNo action by a victim is required.
- Confidentiality (vulnerable system)
- HighSerious loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- HighSerious loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- HighSerious loss of availability on the vulnerable system.
- Confidentiality (other systems)
- NoneNo loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- NoneNo loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- NoneNo loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (jci.com).
Official description
Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑560: Use of Default Credentials. This issue affects iSTAR Ultra: before 2.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
How developers prevent this class of flaw
- Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
- Force the administrator to change the credential upon installation.
- The product administrator could change the defaults upon installation or during operation.
Timeline
- CVE record published.
References
Other vulnerabilities in iSTAR Ultra
- 7.0 High severity
- 7.0 High severity
- 8.7 High severity
- 9.3 Critical severity
- 9.4 Critical severity
- 9.8 Critical severity
Recent Use of Default Credentials vulnerabilities
- 9.3 Critical severity
- 9.8 Critical severity
- 7.2 High severity
- 9.8 Critical severity
- 8.4 High severity
- 8.7 High severity
Spotted an error? Tell us.