CVE-2023-3127
High
Description
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
SeverityHigh
CVSS7.5
Exploit probability—
ProductJohnsoncontrols Istar Ultra Firmware
PublishedJul 11, 2023
First seenJul 11, 2023
Weakness typeCWE-287Improper authentication
How to fix
Update
- johnsoncontrols istar_ultra_firmware6.9.2 or later
- johnsoncontrols istar_ultra_lt_firmware6.9.2 or later
- johnsoncontrols istar_ultra_g2_firmware6.9.2 or later
- johnsoncontrols edge_g2_firmware6.9.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| johnsoncontrols istar_ultra_firmware | 6.8.6 ≤ v < 6.9.2, 6.9.2 | 6.9.2 |
| johnsoncontrols istar_ultra_lt_firmware | 6.8.6 ≤ v < 6.9.2, 6.9.2 | 6.9.2 |
| johnsoncontrols istar_ultra_g2_firmware | v < 6.9.2, 6.9.2 | 6.9.2 |
| johnsoncontrols edge_g2_firmware | v < 6.9.2, 6.9.2 | 6.9.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.