CVE-2025-43875CWE-78command-injection

CVE-2025-43875

published December 24, 2025

CVSS
8.7
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

Under certain circumstances a successful exploitation could result in access to the device.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-24T21:15Z
References (2)
https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-01 · [email protected]https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories · [email protected]
EPSS history
Timeline
  • 24 DEC 15:19Z
    iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo
    cvelistv5