Vulnerability Intelligence Report
Improper Authentication in iSTAR
CVE-2023-3127
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
Exploitability:1.7
Impact Score:5.3
EPSS Probability:0.45%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-287 ↗CWE-287 Improper Authentication
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. | iSTAR Ultra | >6.8.6 < 6.9.2 CU01 (affected) |
| Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. | iSTAR Ultra LT | >6.8.6 < 6.9.2 CU01 (affected) |
| Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. | iSTAR Ultra G2 | 0 < 6.9.2 CU01 (affected) |
| Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. | iSTAR Edge G2 | 0 < 6.9.2 CU01 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.450%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Johnson Controls · Vendor · USA |
| Reserved | 2023-06-06T14:51:53 |
| Published | 2023-07-11T21:06:29 |
| Patch Date | 2023-07-11 |
| Last Updated | 2024-10-22T20:31:09 |
Community Chatter & Buzz