CVE-2025-43874 in iSTAR Ultra
Summary
by MITRE • 11/14/2026
: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows : OS Command Injection.
This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/14/2026
The identified vulnerability represents a critical OS Command Injection flaw within the Johnson Controls iSTAR building automation and security management suite, specifically affecting versions of iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 prior to version 6.9.2.CU02. This class of vulnerability falls under CWE-78, which is defined as Improper Neutralization of Special Elements used in an OS Command. In the context of these industrial control systems and security platforms, such a flaw typically arises when user-supplied input is concatenated directly into system commands without adequate sanitization or validation. An attacker who can interact with the affected application interfaces may inject malicious shell metacharacters, thereby altering the intended command structure executed by the underlying operating system.
The technical mechanism of this exploitation relies on the failure to properly escape or filter special characters such as semicolons, ampersands, pipes, and backticks within input fields that are subsequently passed to OS-level processes. Because these platforms often manage critical infrastructure components including access control readers, video surveillance systems, and fire alarm panels, the ability to execute arbitrary commands on the host server poses a severe risk. The vulnerability allows for remote code execution if the application runs with elevated privileges or if the web service is configured to run as a privileged user, which is common in legacy industrial environments where administrative access is not strictly segregated from operational services.
The operational impact of this vulnerability extends beyond simple data compromise. Successful exploitation enables an attacker to gain full control over the affected server, facilitating unauthorized access to sensitive building management data, including occupant lists, security camera feeds, and historical access logs. Furthermore, it allows for lateral movement within the corporate network if the iSTAR server is integrated with other IT or OT systems. Attackers could install persistent backdoors, modify system configurations to disable logging or intrusion detection mechanisms, or use the compromised host as a pivot point for further attacks against connected physical security devices and building management controllers. This directly undermines the confidentiality, integrity, and availability of the secured environment.
Mitigation strategies must prioritize immediate patching to version 6.9.2.CU02 or later, which addresses the input validation deficiencies responsible for this flaw. In environments where immediate patching is not feasible due to operational constraints, network segmentation should be enforced to restrict access to the iSTAR management interface exclusively from trusted administrative workstations and IP ranges. Additionally, implementing a Web Application Firewall with rules specifically tuned to detect OS command injection patterns can provide an additional layer of defense by blocking malicious payloads before they reach the application logic. Regular security audits focusing on input validation practices across all custom integrations and third-party modules within the iSTAR ecosystem are also recommended to prevent similar vulnerabilities from being introduced through extended functionality.