CVE-2022-21941

published 2022-08-31

CVE-2022-21941: All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the…

Priority P2 66 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
johnson_controls	istar_ultra	>= all versions prior to 6.8.9.CU01 < 6.8.9.CU01	6.8.9.CU01
johnsoncontrols	istar_ultra_firmware	< 6.8.9.cu01	6.8.9.cu01

Detection & IOCs extracted from sources · hover to see the quote

• → Target device is a network-accessible door controller (iSTAR Ultra); any unauthenticated remote request resulting in root-level command execution on this device should be treated as exploitation of CVE-2022-21941. ↗
• → All iSTAR Ultra firmware versions prior to 6.8.9.CU01 are vulnerable; presence of any older firmware version on an internet- or network-exposed device indicates an unpatched, exploitable target. ↗
• → No public exploits were known at time of advisory publication; monitor for anomalous unauthenticated inbound connections to iSTAR Ultra devices, especially those reachable from the internet. ↗

• · The scope is changed (S:C in CVSS vector), indicating successful exploitation can impact resources beyond the iSTAR Ultra device itself — treat compromise as a potential pivot point into broader OT/ICS networks. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77