{"id":"CVE-2025-53697","kind":"vulnerability","aliases":["CVE-2025-53697"],"related":[],"title":"Johnson Controls iSTAR door controllers: default credentials let attackers in","description":"Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑560: Use of Default Credentials.\n\nThis issue affects iSTAR Ultra: before 2.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.","summary":"Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE and Edge G2 access control systems ship with default credentials that are not changed on install. An attacker who knows or finds those credentials can log in and control the system.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["access-control","infrastructure","istar","johnson-controls","physical-security"],"not_affected_if":["fixed-version"],"how_to_check":"- Identify whether any iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE or Edge G2 units are in use on the site\n- Check the installed iSTAR version against the fixed versions listed below\n- Confirm whether the default credentials were changed on each unit (unknown from sources how to verify this)","fix":"- iSTAR Ultra: `2.9.2.CU02` or later\n- iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2: `6.9.2.CU02` or later","status":"open","published_at":"2026-11-13T22:17:18+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","triaged_at":"2026-11-13T22:34:17+00:00","updated_at":"2026-11-13T22:34:17+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T22:34:17Z","model":"claude-haiku-5-5","output":{"fix":"- iSTAR Ultra: `2.9.2.CU02` or later\n- iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2: `6.9.2.CU02` or later","reach":"unknown","title":"Johnson Controls iSTAR door controllers: default credentials let attackers in","impact":"high","summary":"Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE and Edge G2 access control systems ship with default credentials that are not changed on install. An attacker who knows or finds those credentials can log in and control the system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["access-control","johnson-controls","istar","physical-security"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker logs in with default credentials and controls access system","analyst_note":"Check the Johnson Controls advisory for network reach and whether default credentials can be changed, and confirm the fixed versions for each product.","how_to_check":"- Identify whether any iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE or Edge G2 units are in use on the site\n- Check the installed iSTAR version against the fixed versions listed below\n- Confirm whether the default credentials were changed on each unit (unknown from sources how to verify this)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Any site running an affected iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE or Edge G2 access control system before the listed versions is exposed. The sources do not say whether the flaw is reachable from the internet or only from the local network, so the system's network exposure should be checked. Sites on fixed versions can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000832,"input_tokens":4725,"output_tokens":719,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,14A '-53697':12A,15A '2.9.2':114C '560':103C '6.9.2':120C,126C,133C,139C 'access':17B,41B 'access-control':16B 'affect':110C 'allow':101C 'attack':9A,55B 'capec':102C 'chang':51B 'control':2A,5A,18B,23B,28B,42B,66B,76C,80C,85C,90C,97C 'credenti':7A,47B,61B,72C,107C 'cu02':115C,121C,127C,134C,140C 'cve':10A,13A 'default':6A,46B,71C,106C 'door':4A 'edg':39B,99C,136C 'find':59B 'g2':34B,36B,40B,88C,93C,100C,124C,130C,137C 'infrastructur':19B 'instal':53B 'issu':109C 'istar':3A,20B,29B,77C,81C,86C,91C,98C,111C,116C,122C,128C,135C 'johnson':1A,22B,27B,75C,79C,84C,89C,96C 'johnson-control':21B 'know':57B 'let':8A 'log':63B 'physic':25B 'physical-secur':24B 'se':32B,37B,83C,94C,118C,131C 'secur':26B 'ship':44B 'system':43B,68B 'ultra':30B,31B,33B,35B,78C,82C,87C,92C,112C,117C,123C,129C 'use':69C,104C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Any site running an affected iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE or Edge G2 access control system before the listed versions is exposed. The sources do not say whether the flaw is reachable from the internet or only from the local network, so the system's network exposure should be checked. Sites on fixed versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["accesscontrol","high","infrastructure","istar","johnsoncontrols","physicalsecurity"],"campaign_type":null,"search_a":"'-2025':11A,14A '-53697':12A,15A 'attack':9A 'control':2A,5A 'credenti':7A 'cve':10A,13A 'default':6A 'door':4A 'istar':3A 'johnson':1A 'let':8A","search_b":"'access':17B,41B 'access-control':16B 'attack':55B 'chang':51B 'control':18B,23B,28B,42B,66B 'credenti':47B,61B 'default':46B 'edg':39B 'find':59B 'g2':34B,36B,40B 'infrastructur':19B 'instal':53B 'istar':20B,29B 'johnson':22B,27B 'johnson-control':21B 'know':57B 'log':63B 'physic':25B 'physical-secur':24B 'se':32B,37B 'secur':26B 'ship':44B 'system':43B,68B 'ultra':30B,31B,33B,35B","search_c":"'2.9.2':114C '560':103C '6.9.2':120C,126C,133C,139C 'affect':110C 'allow':101C 'capec':102C 'control':76C,80C,85C,90C,97C 'credenti':72C,107C 'cu02':115C,121C,127C,134C,140C 'default':71C,106C 'edg':99C,136C 'g2':88C,93C,100C,124C,130C,137C 'issu':109C 'istar':77C,81C,86C,91C,98C,111C,116C,122C,128C,135C 'johnson':75C,79C,84C,89C,96C 'se':83C,94C,118C,131C 'ultra':78C,82C,87C,92C,112C,117C,123C,129C 'use':69C,104C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-53697","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53697","severity":null,"published_at":"2026-11-13T22:17:18+00:00","modified_at":"2026-11-13T22:17:18+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","fetched_at":"2026-11-13T22:33:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}