CVE-2022-21941

All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.

Score

CVSS 3.1 10.0 Critical

Status

Modified - productsecurity@jci.com

Published

2022-08-31

Last modified

2024-09-17

Weaknesses

CWE-77

Affected products

• Istar Ultra (Johnson Controls)
• Istar Ultra Firmware (Johnsoncontrols)

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-11
• https://www.johnsoncontrols.com/cyber-solutions/security-advisories