{"id":"CVE-2025-53700","kind":"vulnerability","aliases":["CVE-2025-53700"],"related":[],"title":"Johnson Controls iSTAR door controllers: sensitive data stored insecurely, files can be altered","description":"CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation.\n\nThis issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.","summary":"Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE and Edge G2 access control systems store sensitive information insecurely. An attacker with the ability to manipulate files on the system could read or change that data.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["access-control","istar","johnson-controls","physical-security","vendor"],"not_affected_if":["other-products","version-6.9.2.cu02-or-later"],"how_to_check":"- Identify the iSTAR product and version installed on the access control server or controller.\n- Confirm whether the installed version is before `6.9.2.CU02`.","fix":"- iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, Edge G2: move to `6.9.2.CU02` or later.","status":"open","published_at":"2026-11-13T22:17:18+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","triaged_at":"2026-11-13T22:34:33+00:00","updated_at":"2026-11-13T22:34:33+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-13T22:34:33Z","model":"claude-haiku-5-5","output":{"fix":"- iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, Edge G2: move to `6.9.2.CU02` or later.","reach":"unknown","title":"Johnson Controls iSTAR door controllers: sensitive data stored insecurely, files can be altered","impact":"medium","summary":"Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE and Edge G2 access control systems store sensitive information insecurely. An attacker with the ability to manipulate files on the system could read or change that data.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["johnson-controls","istar","access-control","physical-security"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads or alters stored sensitive access control data","analyst_note":"","how_to_check":"- Identify the iSTAR product and version installed on the access control server or controller.\n- Confirm whether the installed version is before `6.9.2.CU02`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-6.9.2.CU02-or-later","other-products"],"who_is_affected":"Organizations running Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE or Edge G2 access control systems on a version before 6.9.2.CU02. Sites not running these products can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4737,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':15A,18A '-53700':16A,19A '15':106C '6.9.2':115C,121C,127C,134C,140C '922':70C 'abil':56B 'access':21B,45B 'access-control':20B 'affect':111C 'allow':104C 'alter':13A 'attack':53B 'capec':105C 'chang':66B 'control':2A,5A,22B,26B,32B,46B,79C,83C,88C,93C,100C 'could':63B 'cu02':116C,122C,128C,135C,141C 'cve':14A,17A 'cwe':69C 'data':7A,68B 'door':4A 'edg':43B,102C,137C 'file':10A,59B,107C 'g2':38B,40B,44B,91C,96C,103C,125C,131C,138C 'inform':50B,75C 'insecur':9A,51B,71C 'issu':110C 'istar':3A,23B,33B,80C,84C,89C,94C,101C,112C,117C,123C,129C,136C 'johnson':1A,25B,31B,78C,82C,87C,92C,99C 'johnson-control':24B 'manipul':58B,108C 'physic':28B 'physical-secur':27B 'read':64B 'se':36B,41B,86C,97C,119C,132C 'secur':29B 'sensit':6A,49B,74C 'storag':72C 'store':8A,48B 'system':47B,62B 'ultra':34B,35B,37B,39B,81C,85C,90C,95C,113C,118C,124C,130C 'vendor':30B 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE or Edge G2 access control systems on a version before 6.9.2.CU02. Sites not running these products can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["accesscontrol","istar","johnsoncontrols","medium","physicalsecurity","vendor"],"campaign_type":null,"search_a":"'-2025':15A,18A '-53700':16A,19A 'alter':13A 'control':2A,5A 'cve':14A,17A 'data':7A 'door':4A 'file':10A 'insecur':9A 'istar':3A 'johnson':1A 'sensit':6A 'store':8A","search_b":"'abil':56B 'access':21B,45B 'access-control':20B 'attack':53B 'chang':66B 'control':22B,26B,32B,46B 'could':63B 'data':68B 'edg':43B 'file':59B 'g2':38B,40B,44B 'inform':50B 'insecur':51B 'istar':23B,33B 'johnson':25B,31B 'johnson-control':24B 'manipul':58B 'physic':28B 'physical-secur':27B 'read':64B 'se':36B,41B 'secur':29B 'sensit':49B 'store':48B 'system':47B,62B 'ultra':34B,35B,37B,39B 'vendor':30B","search_c":"'15':106C '6.9.2':115C,121C,127C,134C,140C '922':70C 'affect':111C 'allow':104C 'capec':105C 'control':79C,83C,88C,93C,100C 'cu02':116C,122C,128C,135C,141C 'cwe':69C 'edg':102C,137C 'file':107C 'g2':91C,96C,103C,125C,131C,138C 'inform':75C 'insecur':71C 'issu':110C 'istar':80C,84C,89C,94C,101C,112C,117C,123C,129C,136C 'johnson':78C,82C,87C,92C,99C 'manipul':108C 'se':86C,97C,119C,132C 'sensit':74C 'storag':72C 'ultra':81C,85C,90C,95C,113C,118C,124C,130C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-53700","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53700","severity":null,"published_at":"2026-11-13T22:17:18+00:00","modified_at":"2026-11-13T22:17:18+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","fetched_at":"2026-11-13T22:33:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}