Johnsoncontrols ≫ Istar Ultra

Under certain circumstances a successful exploitation could result in access to the device.

Under certain circumstances a successful exploitation could result in access to the device.

Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected...

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.