PT-2022-4523 · Unknown · Istar Ultra

Khoa Hoang · Published 2022-08-30 · Updated 2022-10-01 · CVE-2022-21941

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iSTAR Ultra versions prior to 6.8.9.CU01

Description The issue is related to a command injection that could allow an unauthenticated user root access to the system. It is also associated with the lack of data cleaning measures at the controller level, which could enable a remote attacker to elevate their privileges to the root level.

Recommendations For versions prior to 6.8.9.CU01, update to version 6.8.9.CU01 or later to resolve the issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-05392

CVE-2022-21941

Affected Products

Istar Ultra

References · 7

• https://johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21941 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21941 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05392 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-242-11 · Note
• https://johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2022/jci-psa-2022-13.pdf · Note
• https://t.me/cibsecurity/49129 · Telegram Post