CVE-2025-53697 in iSTAR Ultra
Summary
by MITRE • 11/14/2026
Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑560: Use of Default Credentials.
This issue affects iSTAR Ultra: before 2.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/14/2026
The identified vulnerability represents a critical security flaw within the Johnson Controls iSTAR family of physical access control systems, specifically affecting versions of iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 prior to version 6.9.2.CU02. This issue is categorized under CAPEC-560, which describes the Use of Default Credentials attack pattern. In this context, the software retains hardcoded or factory-default authentication credentials that are not changed during initial deployment or installation processes. These default accounts often possess administrative privileges, granting attackers full control over the system if left unmodified. The persistence of these static credentials creates a significant entry point for unauthorized actors who can bypass complex security configurations by simply logging in with known username and password combinations provided by the manufacturer.
From a technical perspective, this vulnerability stems from inadequate credential management practices during the software development lifecycle. Instead of forcing users to set unique, strong passwords upon first login or generating random credentials that are securely stored and transmitted only once, the system allows authentication using static default values. This design flaw violates fundamental principles of secure configuration and identity management. The presence of these accounts means that any individual with network access to the iSTAR platform can attempt to authenticate using these known defaults. Since physical access control systems often integrate with broader enterprise networks or building automation infrastructure, compromising this single point through weak authentication can lead to a cascading failure of security controls across multiple domains.
The operational impact of exploiting default credentials in an access control system is severe and multifaceted. An attacker gaining administrative access via these defaults can disable alarm notifications, unlock secure doors remotely, view sensitive audit logs containing visitor information or employee movement patterns, and potentially modify user permissions to create backdoor accounts that persist even after the vulnerability is patched if not properly audited. In a physical security context, this translates directly to unauthorized physical entry into restricted areas, theft of assets, or sabotage of building infrastructure. Furthermore, because these systems often serve as gateways for other networked services, an attacker could use the compromised iSTAR system as a pivot point to launch lateral movements within the corporate network, escalating from a local access control breach to a widespread enterprise compromise.
This vulnerability aligns with CWE-798: Use of Hard-coded Credentials and CWE-256: Unprotected Storage of Credentials if the default passwords are stored in plaintext or weakly hashed formats within the application database or configuration files. It also maps closely to MITRE ATT&CK technique T1078, specifically Valid Accounts, where adversaries use legitimate credentials obtained through various means, including defaults, to maintain access and evade detection by blending in with normal user activity. The lack of mandatory password change policies upon initial setup exacerbates the risk, allowing attackers to exploit this weakness without needing sophisticated exploitation tools or zero-day exploits.
Mitigation strategies must focus on immediate remediation and long-term configuration hardening. Organizations running affected versions should immediately upgrade to Johnson Controls iSTAR version 6.9.2.CU02 or later, which addresses these default credential issues by enforcing stronger authentication mechanisms. Prior to upgrading, administrators should conduct a thorough audit of all user accounts within the system to identify any remaining default or weak credentials and replace them with strong, unique passwords that meet complexity requirements. It is also critical to disable or remove unnecessary administrative accounts that are not actively used for daily operations. Network segmentation plays a vital role in limiting exposure; iSTAR systems should be placed on isolated VLANs separate from general corporate traffic to prevent unauthorized network access attempts. Additionally, implementing multi-factor authentication where supported and enabling comprehensive logging with alerts for failed login attempts can provide early warning signs of exploitation attempts. Regular security assessments and penetration testing focused on default credential checks are recommended to ensure that such vulnerabilities do not re-emerge in future deployments or updates.