CVE-2025-53699
Description
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑554: Functionality Bypass. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.
Is your site exposed to CVE-2025-53699?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2025-53699? +
How do I check if I'm vulnerable to CVE-2025-53699? +
Related Vulnerabilities
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows …
Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized …
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on …
A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the …
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with …
The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. …
