RCE in Johnson Control Istar Ultra, Ultra Se, G2, G2 Edge

CVE-2025-43873

Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.003 (16.8th percentile) — read the EPSS interpretation.