Vulnerability Details : CVE-2023-3127
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
Vulnerability category: BypassGain privilege
Products affected by CVE-2023-3127
- cpe:2.3:o:johnsoncontrols:istar_ultra_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:johnsoncontrols:istar_ultra_firmware:6.9.2:-:*:*:*:*:*:*
- cpe:2.3:o:johnsoncontrols:istar_ultra_lt_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:johnsoncontrols:istar_ultra_lt_firmware:6.9.2:-:*:*:*:*:*:*
- cpe:2.3:o:johnsoncontrols:istar_ultra_g2_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:johnsoncontrols:istar_ultra_g2_firmware:6.9.2:-:*:*:*:*:*:*
- cpe:2.3:o:johnsoncontrols:edge_g2_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:johnsoncontrols:edge_g2_firmware:6.9.2:-:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-3127
0.26%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 66 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-3127
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L |
1.6
|
5.3
|
Johnson Controls |
CWE ids for CVE-2023-3127
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by:
- nvd@nist.gov (Primary)
- productsecurity@jci.com (Secondary)
References for CVE-2023-3127
-
https://www.cisa.gov/news-events/ics-advisories/icsa-23-192-02
​Sensormatic Electronics iSTAR | CISAThird Party Advisory;US Government Resource
-
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Product Security AdvisoriesVendor Advisory
Jump to