CVE-2025-43874: OS Command Injection
: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows : OS Command Injection.
This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.9.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43874?
CVE-2025-43874 has a risk score of 83, indicating a high severity level.
What types of software are affected by CVE-2025-43874?
CVE-2025-43874 affects various versions of Johnson Controls iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra LT, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2.
How do I fix CVE-2025-43874?
To fix CVE-2025-43874, upgrade to versions 6.9.7.CU01 or later of the affected Johnson Controls software.
What is the nature of the vulnerability in CVE-2025-43874?
CVE-2025-43874 is an OS Command Injection vulnerability that could allow an attacker to execute arbitrary commands on the operating system.
Can CVE-2025-43874 be exploited remotely?
Yes, CVE-2025-43874 can potentially be exploited remotely, posing a significant security risk to affected systems.