Johnsoncontrols Istar Ultra Firmware vulnerabilities

2 CVEs affecting Johnsoncontrols Istar Ultra Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-3127, published 2023-07-11.

More from Johnsoncontrols.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-21941, published 2022-08-31. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.
• CVE-2023-3127, published 2023-07-11. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.