---
id: "CVE-2025-53700"
page: "https://infrastack.ai/live/CVE-2025-53700"
kind: "vulnerability"
aliases: ["CVE-2025-53700"]
title: "Johnson Controls iSTAR door controllers: sensitive data stored insecurely, files can be altered"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["access-control", "istar", "johnson-controls", "physical-security", "vendor"]
not_affected_if: ["other-products", "version-6.9.2.cu02-or-later"]
published_at: "2026-11-13T22:17:18+00:00"
first_seen_at: "2026-11-13T22:33:33+00:00"
updated_at: "2026-11-13T22:34:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53700", "first_seen_at": "2026-11-13T22:33:33+00:00"}]
exploit_sources: []
---

# Johnson Controls iSTAR door controllers: sensitive data stored insecurely, files can be altered

Link for people: https://infrastack.ai/live/CVE-2025-53700 (this .md is for agents)

Johnson Controls iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE and Edge G2 access control systems store sensitive information insecurely. An attacker with the ability to manipulate files on the system could read or change that data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify the iSTAR product and version installed on the access control server or controller.
- Confirm whether the installed version is before `6.9.2.CU02`.

## Fix

- iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, Edge G2: move to `6.9.2.CU02` or later.

## Timeline

- 2026-11-13T22:33:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-53700

## From the sources

CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation.

This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_