CVE-2025-53699: High severity vulnerability

Published Nov 13, 2026

Updated

Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑554: Functionality Bypass.

This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

Event History

Nov 13, 2026

CVE Published

via MITRE·09:50 PM

Data Sourced

via MITRE·09:50 PM

DescriptionWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are affected?

Affected systems are Johnson Controls iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 running versions earlier than 6.9.2.CU02.

What access does an attacker need to exploit this issue?

The vector indicates physical access is required. No privileges or user interaction are required.

What is the potential impact?

The vulnerability can allow functionality bypass through an alternate hardware interface, with high impact to confidentiality, integrity, and availability.

CVE-2025-53699: High severity vulnerability

Event History

Frequently Asked Questions

Which systems are affected?

What access does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected?

What access does an attacker need to exploit this issue?

What is the potential impact?