CVE-2022-21941: Johnsoncontrols Istar Ultra Firmware

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.

Affected products

• Johnsoncontrols Istar Ultra Firmware: before 6.8.9.cu01 (fixed in 6.8.9.cu01)

Published 2022-08-31. Last modified 2026-06-17.