CVE-2025-53698 in iStar Ultra
Summary
by MITRE • 11/14/2026
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass.
This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/14/2026
The vulnerability identified in Johnson Controls iSTAR Ultra and iSTAR Ultra SE systems represents a critical failure in the implementation of access controls for alternate hardware interfaces, specifically enabling an attacker to bypass intended security functionalities through CAPEC-554: Functionality Bypass. This class of weakness typically arises when software or firmware fails to properly validate inputs directed at secondary communication ports such as UART, JTAG, SPI, or USB debug headers before executing commands or exposing internal states. In the context of physical access control systems like iSTAR Ultra, these interfaces are often utilized by developers for debugging and maintenance but may remain enabled in production builds without adequate authentication mechanisms. The absence of a robust protection mechanism allows an adversary with limited physical proximity to exploit these exposed pathways to circumvent standard security protocols, potentially gaining unauthorized administrative privileges or extracting sensitive configuration data that should be restricted to authorized personnel only.
From a technical perspective, the flaw lies in the system's failure to enforce strict separation between development-oriented hardware interfaces and operational runtime environments. When an alternate interface is accessible without proper cryptographic verification or physical presence requirements beyond basic connectivity, it creates a direct path for privilege escalation. An attacker can leverage this exposure to inject malicious commands into the controller’s memory or modify firmware settings that dictate door lock behaviors, alarm triggers, and user permissions. This aligns with CWE-284: Improper Access Control, as the system does not adequately restrict access to resources based on identity or role. Furthermore, because these interfaces often provide low-level hardware access, they can also facilitate memory corruption attacks if input validation is insufficient within the interface handler routines, although the primary reported impact here centers on functionality bypass rather than arbitrary code execution.
The operational impact of this vulnerability is severe for organizations relying on Johnson Controls iSTAR systems for physical security infrastructure. By bypassing standard authentication and authorization checks via alternate hardware interfaces, an attacker could disable alarm systems, unlock secure doors without proper credentials, or tamper with audit logs to cover their tracks. This undermines the integrity of the entire access control ecosystem, allowing unauthorized entry into restricted areas while potentially evading detection by central monitoring stations. The risk is exacerbated in environments where physical security boundaries are assumed to be sufficient; however, this vulnerability demonstrates that logical controls must also defend against direct hardware-level attacks. Attackers do not need complex network exploits or social engineering tactics if they can physically connect to the device’s maintenance port and issue commands directly to the processor, effectively rendering traditional perimeter defenses obsolete for those specific endpoints.
To mitigate these risks, immediate action is required to apply the vendor-released patches that address this deficiency in versions prior to 6.9.2.CU02 for both iSTAR Ultra and iSTAR Ultra SE platforms. Beyond software updates, organizations should implement physical security measures such as locking server rooms or equipment closets where these controllers are housed to prevent unauthorized access to hardware interfaces. Additionally, it is advisable to disable unused debug ports at the firmware level if supported by configuration options, ensuring that only necessary communication channels remain active during normal operations. Security teams should also conduct regular audits of connected devices and monitor for unusual activity on maintenance logs indicative of interface exploitation attempts. Aligning these practices with MITRE ATT&CK techniques such as T1059: Command and Scripting Interpreter or T1217: Browser Dump, depending on the specific attack vector utilized via the hardware port, will help in detecting and responding to potential intrusions that attempt to leverage this functionality bypass for deeper system compromise.