CVE-2025-43876CWE-78command-injection

CVE-2025-43876

published December 24, 2025

CVSS
8.7
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

Under certain circumstances a successful exploitation could result in access to the device.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-24T21:15Z
References (2)
https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-01 · [email protected]https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories · [email protected]
EPSS history
Timeline
  • 24 DEC 15:27Z
    iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings
    cvelistv5