Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Dec 24, 2025Under certain circumstances a successful exploitation could result in access to the device.CVE-2025-43876 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.7
Under certain circumstances a successful exploitation could result in access to the device.
- Product
- iSTAR Ultra, iSTAR Ultra SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 24, 2025Under certain circumstances a successful exploitation could result in access to the device.CVE-2025-43875 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.7
Under certain circumstances a successful exploitation could result in access to the device.
- Product
- iSTAR Ultra, iSTAR Ultra SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 17, 2025Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device.CVE-2025-43873 · Other software · Johnson Control · reported by productsecurity@jci.comHigh 8.7
Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device.
- Product
- iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 17, 2025Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.CVE-2025-61736 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.1
Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.
- Product
- iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jul 28, 2025iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware.CVE-2025-53696 · Other software · Johnson Controls, Inc · reported by ot-cert@dragos.comCritical 9.3
iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.
- Product
- iSTAR Ultra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Jul 28, 2025OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device fiCVE-2025-53695 · Other software · Johnson Controls, Inc · reported by ot-cert@dragos.comCritical 9.4
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.
- Product
- iSTAR Ultra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Jul 11, 2023An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.CVE-2023-3127 · Other software · Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. · reported by productsecurity@jci.comHigh 7.5
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
- Product
- iSTAR Ultra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Aug 31, 2022All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the systemCVE-2022-21941 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 10
All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.
- Product
- iSTAR Ultra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 30, 2017A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module.CVE-2017-17704 · Other software · Swhouse · reported by MITREHigh 7.4
A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible.
- Product
- Istar Ultra Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsystemoverlord.comsystemoverlord.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.