CVE-2025-43873CWE-78

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - setFaultDebounce

High · published December 17, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00289 · 20.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-17T15:53Z
EPSS history
Timeline
  • 17 DEC 15:53Z
    iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - setFaultDebounce
    cvelistv5