Threats tagged 'ghsa-6qw2-rvfm-h4g2'

CVE-2025-43874 is an OS Command Injection vulnerability affecting multiple Johnson Controls iSTAR Ultra product lines prior to version 6.9.2.CU02. The flaw involves improper neutralization of special elements in OS commands, which could allow an attacker with limited privileges to execute arbitrary OS commands. The vulnerability has a high severity score of 8.7 but no known exploits in the wild have been reported. A fixed version 6.9.2.CU02 or later is indicated, though no explicit patch link is provided.