PT-2025-31108 · Unknown · Istar Ultra

Published 2025-07-28 · Updated 2025-07-31 · CVE-2025-53695

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions iSTAR Ultra products (affected versions not specified)

Description An OS Command Injection issue exists in the iSTAR Ultra products web application. An authenticated attacker can exploit this to gain privileged access, specifically 'root' user access, to the device firmware.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-53695

Affected Products

Istar Ultra

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-53695 · Security Note
• https://t.me/CVEtracker/28576 · Telegram Post
• https://twitter.com/CVEnew/status/1949837451574259972 · Twitter Post
• https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-03.txt · Note
• https://twitter.com/CveFindCom/status/1949842186423394506 · Twitter Post
• https://twitter.com/SecAideInfo/status/1950863308979830916 · Twitter Post