CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-25-146-01: Johnson Controls iSTAR Configuration Utility (ICU) tool ↗ source

May 26, 2025 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-25-146-01

Summary

Successful exploitation of this vulnerability may allow an attacker to gain access to memory leaked from the ICU. This utility is only used to configure products that are no longer manufactured or supported. ICU is not used to configure the iSTAR Ultra and the current iSTAR G2 series of controllers. Furthermore, this vulnerability only impacts ICU and the Windows PC it is running on. This vulnerability does not impact iSTARs, including the legacy iSTARs. CVE-2025-26383: The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-25-146-01
Status
Final · version 1
Initial release
2025-05-27
Last revised
2025-05-27
Vendor
Johnson Controls Inc.
Critical infrastructure sectors
Commercial Facilities, Critical Manufacturing, Energy, Government Services and Facilities, Transportation Systems
Deployed
Worldwide
Vendor headquarters
Ireland

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Credit: Reid Wightman (Dragos)

Affected products (1)
  • ICU — <6.9.5

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2025-26383 CWE-457 Use of Uninitialized Variable 7.4 High The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on.

Vendor fix: Johnson Controls recommends users update ICU to Version 6.9.5 or greater.

Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2025-06 ↗

Mitigation: For assistance and additional information, please contact Johnson Controls Trust [email protected] ↗

Affected, fixed & timeline

Affected:

  • ICU <6.9.5

Mitigation: For assistance and additional information, please contact Johnson Controls Trust [email protected]

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2025-26383 6.3 Medium Johnson Controls iSTAR Configuration Utility (ICU) The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that …

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.