CVE-2025-53698: High severity vulnerability
Published Nov 13, 2026
·Updated
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass.
This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02.
Event History
Nov 13, 2026
CVE Published
via MITRE·09:46 PM
Data Sourced
via MITRE·09:46 PM
DescriptionWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are in the affected version range?
Johnson Controls iSTAR Ultra and iSTAR Ultra SE deployments running versions earlier than 6.9.2.CU02 are affected.
2
What level of access does an attacker need?
The vector is physical. The rating indicates no prior privileges or user interaction are required, but exploitation involves an alternate hardware interface.