CVE-2025-61736

iSTAR- Improper Validation of Certificate Expiration

State: Published
Severity: 7.1 High
Published: Dec 17, 2025
Updated: Dec 17, 2025
Reserved: Sep 30, 2025

Description

Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	jci

Weaknesses

CWE-298 Improper Validation of certificate expiration

Affected Products

Product	Versions
iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SEJohnson Controls	iSTAR All versions prior to TLS 1.2Affected

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-04

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.