iSTAR Ultra: Missing Protection Mechanism for Alternate Hardware Interface
CVE-2025-53698 is a high-severity missing protection mechanism for alternate hardware interface vulnerability in iSTAR Ultra from Johnson Controls, with a CVSS 4.0 base score of 7.0 out of 10. It can be exploited with physical access to the device by an unauthenticated attacker, without any action from a user. The record lists version 6.9.2.CU02 as the first without the flaw, so updating iSTAR Ultra to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update iSTAR Ultra to 6.9.2.CU02 or a later version.
- Update iSTAR Ultra SE to 6.9.2.CU02 or a later version.
- Read the advisory on johnsoncontrols.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Johnson Controls | iSTAR Ultra | before 6.9.2.CU02 | 6.9.2.CU02 |
| Johnson Controls | iSTAR Ultra SE | before 6.9.2.CU02 | 6.9.2.CU02 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- PhysicalThe attacker must physically touch the device.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- NoneThe attack does not depend on a particular deployment or configuration.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Confidentiality (vulnerable system)
- HighSerious loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- HighSerious loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- HighSerious loss of availability on the vulnerable system.
- Confidentiality (other systems)
- NoneNo loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- NoneNo loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- NoneNo loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (jci.com).
Official description
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Missing Protection Mechanism for Alternate Hardware Interface
The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers and other external facing unguarded interfaces) allows an attacker to bypass existing protections to the asset that are only performed against the primary path.
How developers prevent this class of flaw
- Protect assets from accesses against all potential interfaces and alternate paths.
- Protect assets from accesses against all potential interfaces and alternate paths.
- Protect assets from accesses against all potential interfaces and alternate paths.
More Missing Protection Mechanism for Alternate Hardware Interface vulnerabilities (CWE-1299)
Timeline
- CVE record published.
References
Other vulnerabilities in iSTAR Ultra
- 7.0 High severity
- 8.4 High severity
- 8.7 High severity
- 9.3 Critical severity
- 9.4 Critical severity
- 9.8 Critical severity
Recent Missing Protection Mechanism for Alternate Hardware Interface vulnerabilities
- 7.9 High severity
- 7.5 High severity
Spotted an error? Tell us.