CVE-2025-53695: Johnson Controls, Inc Istar Ultra

Critical severity, CVSS 9.4. EPSS: 0.9% chance of exploitation in the next 30 days.

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.

Affected products

• Johnson Controls, Inc Istar Ultra: up to and including 6.9.2

Published 2025-07-28. Last modified 2026-06-17.