Riskcovery

CVE-2024-32752

Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

State
Published
Severity
8.8 High
Published
Jun 6, 2024
Updated
Apr 24, 2025
Reserved
Apr 17, 2024

Read the record on cve.org

Description

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access

Scores

CVSSScoreVectorSource
4.08.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:Njci
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HCISA-ADP

Weaknesses

  • CWE-306 Missing Authentication for Critical Function

Affected Products

ProductVersions
iSTAR Configuration Utility (ICU)Johnson Controls
  • All and earlierAffected
iSTAR Pro, Edge and eXJohnson Controls
  • All and earlierAffected
iSTAR Ultra and Ultra LTJohnson Controls
  • before 6.6.BAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.