VulnerabilityDeferred

CVE-2025-53696

These firmware parts may contain malicious code.

CRITICAL 9.3EPSS 0.10%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.10%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.10% probability · 1th percentile
CISA KEV: Not listed
Weakness: CWE-494
Source: ot-cert@dragos.com

References

https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-03.txt

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.