Johnson Controls Software House iStar Door Controller (Update A)
1. EXECUTIVE SUMMARY
- CVSS v4 8.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Johnson Controls Inc.
- Equipment: Software House iStar Pro, Edge, eX, Ultra and Ultra LT controllers, ICU
- Vulnerability: Missing Authentication for Critical Function
2. RISK EVALUATION
Successful exploitation of this vulnerability may allow an attacker to gain unauthorized access to the iSTAR Pro door controller.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Johnson Controls reports that the following products are affected:
- Software House iStar Pro, Edge and eX door controllers: all versions
- Software House iStar Ultra and Ultra LT door controllers: Firmware prior to 6.6.B
- iSTAR Configuration Utility (ICU) Tool: All versions
3.2 Vulnerability Overview
3.2.1 Missing Authentication for Critical Function CWE-306
iSTAR door controllers running firmware prior to version 6.6.B are vulnerable because their communication with the ICU does not support authentication.
CVE-2024-32752 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2024-32752. A base score of 8.8 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: Ireland
3.4 RESEARCHER
Reid Wightman of Dragos reported this vulnerability to Johnson Controls, Inc.
4. MITIGATIONS
Johnson Controls recommends users replace the iSTAR Pro, Edge, and eX door controllers with current generation iSTAR door controllers, such as iSTAR Ultra G2 and Edge G2, which support proper authentication and prevent the ICU from making configuration changes. Ensure that iSTAR Ultra and Ultra LT door controllers are running firmware version 6.6.B or later.
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2024-06-v2
Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems.
Further ICS security notices and product security guidance are located at Johnson Controls product security website
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
5. UPDATE HISTORY
- June 6, 2024: Initial Publication
- July 29, 2025: Update A - Added iStar Pro, Edge, eX, Ultra and Ultra LT to affected products and mitigation sections.
This product is provided subject to this Notification and this Privacy & Use policy.
Vendor
- Johnson Controls Inc.