CVE-2024-32752: Johnson Controls Istar Configuration Utility Icu

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access

Affected products

• Johnson Controls Istar Configuration Utility Icu
• Johnson Controls Istar Pro, Edge And Ex
• Johnson Controls Istar Ultra And Ultra Lt: before 6.6.B (fixed in 6.6.B)
• Johnsoncontrols Icu: any version
• Johnsoncontrols Software House Istar Pro Door Controller: any version

Published 2024-06-06. Last modified 2026-06-17.