CVE-2024-32752
Critical
Description
The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access
SeverityCritical
CVSS9.1
Exploit probability—
ProductiSTAR Configuration Utility (ICU)
PublishedJun 6, 2024
First seenJun 6, 2024
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- Johnson Controls iSTAR Ultra and Ultra LT6.6.B or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Johnson Controls iSTAR Configuration Utility (ICU) | 0 | — |
| Johnson Controls iSTAR Pro, Edge and eX | 0 | — |
| Johnson Controls iSTAR Ultra and Ultra LT | v < 6.6.B | 6.6.B |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.