Improper Authentication in iSTAR
Priority MEDIUM 43CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00562 46th percentileScored 2026-11-07
Fix Fixed iSTAR Ultra (Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.): 6.9.2 CU01iSTAR Ultra LT (Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.): 6.9.2 CU01+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Johnson Controls | iSTAR Ultra | >6.8.6 to before 6.9.2 CU01 | 6.9.2 CU01 | Patch available | CNA |
| Johnson Controls | iSTAR Ultra LT | >6.8.6 to before 6.9.2 CU01 | 6.9.2 CU01 | Patch available | CNA |
| Johnson Controls | iSTAR Ultra G2 | before 6.9.2 CU01 | 6.9.2 CU01 | Patch available | CNA |
| Johnson Controls | iSTAR Edge G2 | before 6.9.2 CU01 | 6.9.2 CU01 | Patch available | CNA |
- iSTAR Ultra VendorJohnson Controls Affected >6.8.6 to before 6.9.2 CU01 Fixed in 6.9.2 CU01 Patch available CNA
- iSTAR Ultra LT VendorJohnson Controls Affected >6.8.6 to before 6.9.2 CU01 Fixed in 6.9.2 CU01 Patch available CNA
- iSTAR Ultra G2 VendorJohnson Controls Affected before 6.9.2 CU01 Fixed in 6.9.2 CU01 Patch available CNA
- iSTAR Edge G2 VendorJohnson Controls Affected before 6.9.2 CU01 Fixed in 6.9.2 CU01 Patch available CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:johnsoncontrols:istar_ultra_firmware:*:*:*:*:*:*:*:* | 6.8.6 to before 6.9.2 | Vulnerable | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:istar_ultra_firmware:6.9.2:-:*:*:*:*:*:* | 6.9.2 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:istar_ultra:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:istar_ultra_lt_firmware:*:*:*:*:*:*:*:* | 6.8.6 to before 6.9.2 | Vulnerable | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:istar_ultra_lt_firmware:6.9.2:-:*:*:*:*:*:* | 6.9.2 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:istar_ultra_lt:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:istar_ultra_g2_firmware:*:*:*:*:*:*:*:* | before 6.9.2 | Vulnerable | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:istar_ultra_g2_firmware:6.9.2:-:*:*:*:*:*:* | 6.9.2 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:istar_ultra_g2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
| cpe:2.3:o:johnsoncontrols:edge_g2_firmware:*:*:*:*:*:*:*:* | before 6.9.2 | Vulnerable | Johnson Controls |
- cpe:2.3:o:johnsoncontrols:istar_ultra_firmware:*:*:*:*:*:*:*:* Versions 6.8.6 to before 6.9.2 Vulnerable ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:istar_ultra_firmware:6.9.2:-:*:*:*:*:*:* Versions 6.9.2 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:istar_ultra:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:istar_ultra_lt_firmware:*:*:*:*:*:*:*:* Versions 6.8.6 to before 6.9.2 Vulnerable ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:istar_ultra_lt_firmware:6.9.2:-:*:*:*:*:*:* Versions 6.9.2 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:istar_ultra_lt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:istar_ultra_g2_firmware:*:*:*:*:*:*:*:* Versions before 6.9.2 Vulnerable ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:istar_ultra_g2_firmware:6.9.2:-:*:*:*:*:*:* Versions 6.9.2 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:istar_ultra_g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
- cpe:2.3:o:johnsoncontrols:edge_g2_firmware:*:*:*:*:*:*:*:* Versions before 6.9.2 Vulnerable ·Johnson Controls
Show 2 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:johnsoncontrols:edge_g2_firmware:6.9.2:-:*:*:*:*:*:* | 6.9.2 | Vulnerable | Johnson Controls |
| cpe:2.3:h:johnsoncontrols:edge_g2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Johnson Controls |
- cpe:2.3:o:johnsoncontrols:edge_g2_firmware:6.9.2:-:*:*:*:*:*:* Versions 6.9.2 Vulnerable ·Johnson Controls
- cpe:2.3:h:johnsoncontrols:edge_g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Johnson Controls
Remediation
- Fix · CNA iSTAR Ultra (Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.) Fixed in 6.9.2 CU01
- Fix · CNA iSTAR Ultra LT (Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.) Fixed in 6.9.2 CU01
- Fix · CNA iSTAR Ultra G2 (Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.) Fixed in 6.9.2 CU01
- Fix · CNA iSTAR Edge G2 (Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.) Fixed in 6.9.2 CU01
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3127
- 2026-10-03 Alias added: GHSA-pw83-8wqr-6w84
References
Sources
- CVE-2023-3127 · CVE Program
- CVE-2023-3127 · NVD
- FIRST EPSS
- GHSA-pw83-8wqr-6w84 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences