{"id":"CVE-2025-53697","aliases":[],"cve":{"records":[{"id":"CVE-2025-53697","source":"jci","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2025-07-08T14:48:42.604Z","published":"2026-11-13T21:37:44.321Z","modified":"2026-11-13T21:41:47.141Z"}],"publishers":[{"name":"jci","role":"CNA","organizationId":"7281d04a-a537-43df-bfb4-fa4110af9d01","modified":"2026-11-13T21:41:47.141Z"}],"references":[{"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","tags":[],"source":"jci"}],"weaknesses":[{"id":"CWE-1392","description":"CWE-1392 Use of default credentials","source":"jci"}],"applicability":[{"source":"jci","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:johnson_controls:istar_ultra:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2.9.2.cu02"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:johnson_controls:istar_ultra_se:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"6.9.2.cu02"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:johnson_controls:istar_ultra_g2:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"6.9.2.cu02"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:johnson_controls:istar_ultra_g2_se:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"6.9.2.cu02"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:johnson_controls:istar_edge_g2:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"6.9.2.cu02"}]}]}]}],"prioritization":[]},"title":"Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls…","titleSource":"jci","descriptionSource":"jci","description":"Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑560: Use of Default Credentials.\n\nThis issue affects iSTAR Ultra: before 2.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.","score":8.4,"severity":"high","published":"2026-11-13T21:37:44.321Z","modified":"2026-11-13T21:41:47.141Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Johnson Controls","name":"iSTAR Ultra","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2.9.2.CU02","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"jci","url":"https://www.cve.org/CVERecord?id=CVE-2025-53697"},{"vendor":"Johnson Controls","name":"iSTAR Ultra SE","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"6.9.2.CU02","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"jci","url":"https://www.cve.org/CVERecord?id=CVE-2025-53697"},{"vendor":"Johnson Controls","name":"iSTAR Ultra G2","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"6.9.2.CU02","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"jci","url":"https://www.cve.org/CVERecord?id=CVE-2025-53697"},{"vendor":"Johnson Controls","name":"iSTAR Ultra G2 SE","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"6.9.2.CU02","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"jci","url":"https://www.cve.org/CVERecord?id=CVE-2025-53697"},{"vendor":"Johnson Controls","name":"iSTAR Edge G2","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"6.9.2.CU02","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"jci","url":"https://www.cve.org/CVERecord?id=CVE-2025-53697"}],"remediation":[],"references":["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"],"sources":[{"name":"CVE","id":"CVE-2025-53697","modified":"2026-11-13T21:41:47.141Z","url":"https://www.cve.org/CVERecord?id=CVE-2025-53697"}],"assessments":[{"source":"jci","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.4}],"sourceAffected":[],"observedAt":"2026-11-13T22:14:59.319Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:40:33.739Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-13T22:45:34.752Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-13T22:45:36.603Z","attemptedAt":"2026-11-13T22:45:36.603Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T22:45:37.177Z","attemptedAt":"2026-11-13T22:45:37.177Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T22:45:37.153Z","attemptedAt":"2026-11-13T22:45:37.153Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2025-211326","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-211326","modified":"Nov 13, 2026, 9:41:47 PM","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T22:45:37.177Z"}],"aiSummary":{"text":"Johnson Controls' iSTAR devices use default credentials, affecting versions before 2.9.2.CU02 for iSTAR Ultra and before 6.9.2.CU02 for iSTAR Ultra SE, G2, G2 SE, and Edge G2. This weakness may allow unauthorized access. The impact is unspecified.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T22:21:08.915Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2025-53697"}]}}