iSTAR Ultra
Description
Command injection in iSTAR Ultra prior to 6.8.9.CU01 allows unauthenticated remote attackers to execute arbitrary commands as root.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Command injection in iSTAR Ultra prior to 6.8.9.CU01 allows unauthenticated remote attackers to execute arbitrary commands as root.
Vulnerability
The iSTAR Ultra door controller by Sensormatic Electronics (a Johnson Controls subsidiary) is vulnerable to command injection (CWE-77) in all firmware versions prior to 6.8.9.CU01 [2]. An unauthenticated attacker can send a malicious request over the network to inject arbitrary operating system commands.
Exploitation
No authentication, user interaction, or special privileges are required. With low attack complexity, an attacker exploits the improper neutralization of special elements by crafting a request that includes command syntax. The vulnerable code path is reachable over the network without any prior access [2].
Impact
Successful exploitation grants the attacker root-level access to the device, leading to complete compromise of confidentiality, integrity, and availability. The CVSS v3 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) [2].
Mitigation
Sensormatic Electronics released firmware version 6.8.9.CU01 to remediate the vulnerability [2]. Users should update immediately and follow the detailed instructions in Johnson Controls Product Security Advisory JCI-PSA-2022-13. Additionally, CISA recommends minimizing network exposure and isolating control system devices behind firewalls [2].
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: <6.8.9.CU01
- Johnson Controls/iSTAR Ultrav5Range: all versions prior to 6.8.9.CU01
Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
2- www.cisa.gov/uscert/ics/advisories/icsa-22-242-11mitrethird-party-advisoryx_refsource_CERT
- www.johnsoncontrols.com/cyber-solutions/security-advisoriesmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.