SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityDeferred

CVE-2025-26386

Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability.

HIGH 7.1EPSS 0.41%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the ICU tool.

CVSS 4.0
7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS
0.41% probability · 34th percentile
CISA KEV
Not listed
Weakness
CWE-121
Source
productsecurity@jci.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.