iSTAR Ultra vulnerabilities
7 known vulnerabilities in iSTAR Ultra from Johnson Controls. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.0 High severity
iSTAR Ultra: Missing Protection Mechanism for Alternate Hardware Interface
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑5
- 7.0 High severity
iSTAR Ultra: Missing Protection Mechanism for Alternate Hardware Interface
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.
- 8.4 High severity
iSTAR Ultra: Use of Default Credentials
Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑560: Use of Default Credentials. Thi
- 8.7 High severity
iSTAR Ultra: Improper Neutralization of Special Elements used in an OS Command
: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows :
- 9.3 Critical severity
iSTAR Ultra: Download of Code Without Integrity Check
iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.
- 9.4 Critical severity
iSTAR Ultra: Improper Neutralization of Special Elements used in an OS Command
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.
- 9.8 Critical severity
iSTAR Ultra: Improper Neutralization of Special Elements used in a Command
All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.