PT-2025-23080 · Johnson Controls · Istar Config Utility

Reid Wightman · Published 2025-05-28 · Updated 2025-06-11 · CVE-2025-26383

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Johnson Controls' iSTAR Config Utility versions prior to 6.9.5

Description A memory leak flaw in the iSTAR Config Utility could lead to data leaks, potentially exposing sensitive information. The issue affects versions prior to 6.9.5. Updating to version 6.9.5 or later is essential to mitigate this issue.

Recommendations For versions prior to 6.9.5, update to version 6.9.5 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-457

Related Identifiers

CVE-2025-26383

Affected Products

Istar Config Utility

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-26383 · Security Note
• https://twitter.com/CVEnew/status/1932828334758527089 · Twitter Post
• https://twitter.com/TheDakospy/status/1929757146012688735 · Twitter Post
• https://t.me/cvetracker/26037 · Telegram Post
• https://johnsoncontrols.com/trust-center/cybersecurity/security-advisories · Note
• https://twitter.com/TweetThreatNews/status/1927734761679650957 · Twitter Post
• https://twitter.com/CloneSystemsInc/status/1927689123805974676 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-146-01 · Note