CVE-2024-32752

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Johnson Controls	iSTAR Configuration Utility (ICU)	<= All
Johnson Controls	iSTAR Pro, Edge and eX	<= All
Johnson Controls	iSTAR Ultra and Ultra LT	< 6.6.B
johnsoncontrols	software_house_istar_pro_door_controller	all
johnsoncontrols	icu	all

References

Timeline

Published: Jun 6, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-327537.0Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-CVE-2024-327543.1Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, seri CVE-2024-327559.1Under certain circumstances the web interface will accept characters unrelated to the expected input.CVE-2024-327566.8Under certain circumstances the Linux users credentials may be recovered by an authenticated user.CVE-2024-327576.8Under certain circumstances unnecessary user details are provided within system logs CVE-2024-327587.5Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchang CVE-2024-327597.7Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials.CVE-2024-32764.8The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 do CVE-2024-327606.5When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker pr CVE-2024-327616.5Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries CVE-2024-327626.1A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow users to in CVE-2024-327638.8A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,