RCE in Johnson Controls Istar Ultra G2, G2 Se, Edge

CVE-2025-43875

Under certain circumstances a successful exploitation could result in access to the device.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.003 (17.8th percentile) — read the EPSS interpretation.