{"id":"CVE-2025-43874","kind":"vulnerability","aliases":["CVE-2025-43874"],"related":[],"title":"Johnson Controls iSTAR access controllers: OS command injection before 6.9.2.CU02","description":": Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows : OS Command Injection.\n\nThis issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.","summary":"Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE and Edge G2 building access controllers fail to neutralize special characters in OS commands. An attacker who can reach the system may be able to run operating system commands on it.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","istar","johnson-controls","physical-access-control"],"not_affected_if":["version-6.9.2.cu02-or-later"],"how_to_check":"- Check the installed iSTAR version against the affected range listed in the sources (before 6.9.2.CU02).","fix":"- iSTAR Ultra: `6.9.2.CU02`\n- iSTAR Ultra SE: `6.9.2.CU02`\n- iSTAR Ultra G2: `6.9.2.CU02`\n- iSTAR Ultra G2 SE: `6.9.2.CU02`\n- iSTAR Edge G2: `6.9.2.CU02`","status":"open","published_at":"2026-11-13T22:17:18+00:00","first_seen_at":"2026-11-13T22:33:32+00:00","triaged_at":"2026-11-13T22:34:17+00:00","updated_at":"2026-11-13T22:34:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T22:34:17Z","model":"claude-haiku-5-5","output":{"fix":"- iSTAR Ultra: `6.9.2.CU02`\n- iSTAR Ultra SE: `6.9.2.CU02`\n- iSTAR Ultra G2: `6.9.2.CU02`\n- iSTAR Ultra G2 SE: `6.9.2.CU02`\n- iSTAR Edge G2: `6.9.2.CU02`","reach":"unknown","title":"Johnson Controls iSTAR access controllers: OS command injection before 6.9.2.CU02","impact":"high","summary":"Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE and Edge G2 building access controllers fail to neutralize special characters in OS commands. An attacker who can reach the system may be able to run operating system commands on it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["johnson-controls","istar","physical-access-control"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the access control controller.","analyst_note":"Check the Johnson Controls advisory for attack prerequisites, network exposure and any workaround; the NVD entry alone does not say.","how_to_check":"- Check the installed iSTAR version against the affected range listed in the sources (before 6.9.2.CU02).\n- unknown for other checks: the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-6.9.2.CU02-or-later"],"who_is_affected":"Organizations running Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE or Edge G2 building access control systems below version 6.9.2.CU02 are affected. The sources do not say what network exposure or configuration is required to trigger the flaw.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000817,"input_tokens":4722,"output_tokens":689,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':13A,16A '-43874':14A,17A '6.9.2':10A,115C,121C,127C,134C,140C 'abl':61B 'access':4A,25B,42B 'affect':111C 'allow':105C 'attack':53B 'build':41B 'charact':48B 'command':7A,51B,66B,76C,107C 'control':2A,5A,22B,26B,28B,43B,80C,84C,89C,94C,101C 'cu02':11A,116C,122C,128C,135C,141C 'cve':12A,15A 'edg':39B,103C,137C 'element':71C 'fail':44B 'g2':34B,36B,40B,92C,97C,104C,125C,131C,138C 'improp':67C 'infrastructur':18B 'inject':8A,108C 'issu':110C 'istar':3A,19B,29B,81C,85C,90C,95C,102C,112C,117C,123C,129C,136C 'johnson':1A,21B,27B,79C,83C,88C,93C,100C 'johnson-control':20B 'may':59B 'neutral':46B,68C 'oper':64B 'os':6A,50B,75C,106C 'physic':24B 'physical-access-control':23B 'reach':56B 'run':63B 'se':32B,37B,87C,98C,119C,132C 'special':47B,70C 'system':58B,65B 'ultra':30B,31B,33B,35B,82C,86C,91C,96C,113C,118C,124C,130C 'use':72C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE or Edge G2 building access control systems below version 6.9.2.CU02 are affected. The sources do not say what network exposure or configuration is required to trigger the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","istar","johnsoncontrols","physicalaccesscontrol"],"campaign_type":null,"search_a":"'-2025':13A,16A '-43874':14A,17A '6.9.2':10A 'access':4A 'command':7A 'control':2A,5A 'cu02':11A 'cve':12A,15A 'inject':8A 'istar':3A 'johnson':1A 'os':6A","search_b":"'abl':61B 'access':25B,42B 'attack':53B 'build':41B 'charact':48B 'command':51B,66B 'control':22B,26B,28B,43B 'edg':39B 'fail':44B 'g2':34B,36B,40B 'infrastructur':18B 'istar':19B,29B 'johnson':21B,27B 'johnson-control':20B 'may':59B 'neutral':46B 'oper':64B 'os':50B 'physic':24B 'physical-access-control':23B 'reach':56B 'run':63B 'se':32B,37B 'special':47B 'system':58B,65B 'ultra':30B,31B,33B,35B","search_c":"'6.9.2':115C,121C,127C,134C,140C 'affect':111C 'allow':105C 'command':76C,107C 'control':80C,84C,89C,94C,101C 'cu02':116C,122C,128C,135C,141C 'edg':103C,137C 'element':71C 'g2':92C,97C,104C,125C,131C,138C 'improp':67C 'inject':108C 'issu':110C 'istar':81C,85C,90C,95C,102C,112C,117C,123C,129C,136C 'johnson':79C,83C,88C,93C,100C 'neutral':68C 'os':75C,106C 'se':87C,98C,119C,132C 'special':70C 'ultra':82C,86C,91C,96C,113C,118C,124C,130C 'use':72C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-43874","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43874","severity":null,"published_at":"2026-11-13T22:17:18+00:00","modified_at":"2026-11-13T22:17:18+00:00","first_seen_at":"2026-11-13T22:33:32+00:00","fetched_at":"2026-11-13T22:33:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}