RCE in Johnson Controls, Inc Istar Ultra

CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.009 (56.0th percentile) — read the EPSS interpretation.