---
id: "CVE-2025-53697"
page: "https://infrastack.ai/live/CVE-2025-53697"
kind: "vulnerability"
aliases: ["CVE-2025-53697"]
title: "Johnson Controls iSTAR door controllers: default credentials let attackers in"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["access-control", "infrastructure", "istar", "johnson-controls", "physical-security"]
not_affected_if: ["fixed-version"]
published_at: "2026-11-13T22:17:18+00:00"
first_seen_at: "2026-11-13T22:33:33+00:00"
updated_at: "2026-11-13T22:34:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53697", "first_seen_at": "2026-11-13T22:33:33+00:00"}]
exploit_sources: []
---

# Johnson Controls iSTAR door controllers: default credentials let attackers in

Link for people: https://infrastack.ai/live/CVE-2025-53697 (this .md is for agents)

Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE and Edge G2 access control systems ship with default credentials that are not changed on install. An attacker who knows or finds those credentials can log in and control the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify whether any iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE or Edge G2 units are in use on the site
- Check the installed iSTAR version against the fixed versions listed below
- Confirm whether the default credentials were changed on each unit (unknown from sources how to verify this)

## Fix

- iSTAR Ultra: `2.9.2.CU02` or later
- iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2: `6.9.2.CU02` or later

## Timeline

- 2026-11-13T22:33:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-53697

## From the sources

Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑560: Use of Default Credentials.

This issue affects iSTAR Ultra: before 2.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_