Johnson Controls Software House iStar Door Controller (Update A)

Risk Summary

Successful exploitation of this vulnerability may allow an attacker to gain unauthorized access to the iSTAR Pro door controller.

CVEs (1)

Remediations

• Johnson Controls recommends users replace the iSTAR Pro, Edge, and eX door controllers with current generation iSTAR door controllers, such as iSTAR Ultra G2 and Edge G2, which support proper authentication and prevent the ICU from making configuration changes. Ensure that iSTAR Ultra and Ultra LT door controllers are running firmware version 6.6.B or later.
• For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2024-06-v2
• Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems.
• Further ICS security notices and product security guidance are located at Johnson Controls product security websiteOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

Affected Vendors

Affected Products (3)

Affected Sectors

Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy