---
id: "CVE-2025-43874"
page: "https://infrastack.ai/live/CVE-2025-43874"
kind: "vulnerability"
aliases: ["CVE-2025-43874"]
title: "Johnson Controls iSTAR access controllers: OS command injection before 6.9.2.CU02"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "istar", "johnson-controls", "physical-access-control"]
not_affected_if: ["version-6.9.2.cu02-or-later"]
published_at: "2026-11-13T22:17:18+00:00"
first_seen_at: "2026-11-13T22:33:32+00:00"
updated_at: "2026-11-13T22:34:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43874", "first_seen_at": "2026-11-13T22:33:32+00:00"}]
exploit_sources: []
---

# Johnson Controls iSTAR access controllers: OS command injection before 6.9.2.CU02

Link for people: https://infrastack.ai/live/CVE-2025-43874 (this .md is for agents)

Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE and Edge G2 building access controllers fail to neutralize special characters in OS commands. An attacker who can reach the system may be able to run operating system commands on it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed iSTAR version against the affected range listed in the sources (before 6.9.2.CU02).

## Fix

- iSTAR Ultra: `6.9.2.CU02`
- iSTAR Ultra SE: `6.9.2.CU02`
- iSTAR Ultra G2: `6.9.2.CU02`
- iSTAR Ultra G2 SE: `6.9.2.CU02`
- iSTAR Edge G2: `6.9.2.CU02`

## Timeline

- 2026-11-13T22:33:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-43874

## From the sources

: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows : OS Command Injection.

This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_