iSTAR Configuration Utility (ICU) vulnerabilities

2 known vulnerabilities in iSTAR Configuration Utility (ICU) from Johnson Controls. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  iSTAR Configuration Utility (ICU): Stack-based Buffer Overflow

  CVE-2025-26386Jan 28, 2026Johnson Controls

  Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the ope

• 8.8 High severity

  iSTAR Configuration Utility (ICU): Missing Authentication for Critical Functionality

  CVE-2024-32752Jun 6, 2024Johnson Controls

  The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access