{"id":"CVE-2025-53698","kind":"vulnerability","aliases":["CVE-2025-53698"],"related":[],"title":"Johnson Controls iSTAR Ultra: alternate hardware interface lets attackers bypass access controls","description":"Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass.\n\nThis issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02.","summary":"Johnson Controls iSTAR Ultra and iSTAR Ultra SE lack a protection mechanism on an alternate hardware interface, which lets an attacker bypass intended functionality. The sources describe it as a functionality bypass (CAPEC-554) and do not detail what an attacker can reach.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["access-control","infrastructure","istar-ultra","johnson-controls","physical-security"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed iSTAR Ultra or iSTAR Ultra SE version in the product's software about or status screen, as the sources do not give a command.","fix":"- iSTAR Ultra: upgrade to `6.9.2.CU02` or later\n- iSTAR Ultra SE: upgrade to `6.9.2.CU02` or later","status":"open","published_at":"2026-11-13T22:17:18+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","triaged_at":"2026-11-13T22:34:29+00:00","updated_at":"2026-11-13T22:34:29+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-13T22:34:29Z","model":"claude-haiku-5-5","output":{"fix":"- iSTAR Ultra: upgrade to `6.9.2.CU02` or later\n- iSTAR Ultra SE: upgrade to `6.9.2.CU02` or later","reach":"unknown","title":"Johnson Controls iSTAR Ultra: alternate hardware interface lets attackers bypass access controls","impact":"medium","summary":"Johnson Controls iSTAR Ultra and iSTAR Ultra SE lack a protection mechanism on an alternate hardware interface, which lets an attacker bypass intended functionality. The sources describe it as a functionality bypass (CAPEC-554) and do not detail what an attacker can reach.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["johnson-controls","istar-ultra","physical-security","access-control"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker bypasses intended access control functionality on the system","analyst_note":"Confirm the alternate hardware interface, its reachability and exploit preconditions from the Johnson Controls advisory, which the sources do not link.","how_to_check":"- Check the installed iSTAR Ultra or iSTAR Ultra SE version in the product's software about or status screen, as the sources do not give a command.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Organizations running Johnson Controls iSTAR Ultra or iSTAR Ultra SE before 6.9.2.CU02 are affected. The sources do not say which hardware interface is involved or what configuration exposes it, so teams should check whether the alternate interface is reachable on their deployment.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000783,"input_tokens":4588,"output_tokens":648,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-53698':15A,18A '-554':65B '554':96C '6.9.2':105C,111C 'access':11A,20B 'access-control':19B 'affect':101C 'allow':94C 'altern':5A,46B,79C 'attack':9A,52B,72B 'bypass':10A,53B,63B,98C 'capec':64B,95C 'control':2A,12A,21B,28B,33B,85C,90C 'cu02':106C,112C 'cve':13A,16A 'describ':58B 'detail':69B 'function':55B,62B,97C 'hardwar':6A,47B,80C 'infrastructur':22B 'intend':54B 'interfac':7A,48B,81C 'issu':100C 'istar':3A,24B,34B,37B,86C,91C,102C,107C 'istar-ultra':23B 'johnson':1A,27B,32B,84C,89C 'johnson-control':26B 'lack':40B 'let':8A,50B 'mechan':43B,77C 'miss':75C 'physic':30B 'physical-secur':29B 'protect':42B,76C 'reach':74B 'se':39B,93C,109C 'secur':31B 'sourc':57B 'ultra':4A,25B,35B,38B,87C,92C,103C,108C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Johnson Controls iSTAR Ultra or iSTAR Ultra SE before 6.9.2.CU02 are affected. The sources do not say which hardware interface is involved or what configuration exposes it, so teams should check whether the alternate interface is reachable on their deployment.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["accesscontrol","high","infrastructure","istarultra","johnsoncontrols","physicalsecurity"],"campaign_type":null,"search_a":"'-2025':14A,17A '-53698':15A,18A 'access':11A 'altern':5A 'attack':9A 'bypass':10A 'control':2A,12A 'cve':13A,16A 'hardwar':6A 'interfac':7A 'istar':3A 'johnson':1A 'let':8A 'ultra':4A","search_b":"'-554':65B 'access':20B 'access-control':19B 'altern':46B 'attack':52B,72B 'bypass':53B,63B 'capec':64B 'control':21B,28B,33B 'describ':58B 'detail':69B 'function':55B,62B 'hardwar':47B 'infrastructur':22B 'intend':54B 'interfac':48B 'istar':24B,34B,37B 'istar-ultra':23B 'johnson':27B,32B 'johnson-control':26B 'lack':40B 'let':50B 'mechan':43B 'physic':30B 'physical-secur':29B 'protect':42B 'reach':74B 'se':39B 'secur':31B 'sourc':57B 'ultra':25B,35B,38B","search_c":"'554':96C '6.9.2':105C,111C 'affect':101C 'allow':94C 'altern':79C 'bypass':98C 'capec':95C 'control':85C,90C 'cu02':106C,112C 'function':97C 'hardwar':80C 'interfac':81C 'issu':100C 'istar':86C,91C,102C,107C 'johnson':84C,89C 'mechan':77C 'miss':75C 'protect':76C 'se':93C,109C 'ultra':87C,92C,103C,108C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-53698","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53698","severity":null,"published_at":"2026-11-13T22:17:18+00:00","modified_at":"2026-11-13T22:17:18+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","fetched_at":"2026-11-13T22:33:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}