The Cybersecurity and Infrastructure Security Agency (CISA) released a significant Industrial Control Systems (ICS) advisory targeting a memory leak vulnerability in Johnson Controls’ iSTAR Configuration Utility (ICU) Tool, highlighting ongoing security challenges facing critical infrastructure sectors worldwide.
This latest advisory highlights the persistent threat landscape facing industrial control systems, which form the backbone of critical infrastructure across various sectors, including commercial facilities, manufacturing, energy, and transportation.
Johnson Controls iSTAR Utility Flaw (CVE-2025-26383)
The advisory ICSA-25-146-01 reveals a serious security flaw in Johnson Controls’ iSTAR Configuration Utility, cataloged as CVE-2025-26383.
The vulnerability stems from a “Use of Uninitialized Variable” weakness (CWE-457), which occurs when code uses a variable that has not been properly initialized, resulting in unpredictable or unintended consequences.
All versions of the ICU tool prior to 6.9.5 are affected by this memory leak issue, which could result in unintended exposure of unauthorized data to attackers.
The vulnerability was responsibly disclosed by Reid Wightman of Dragos, demonstrating the collaborative effort between cybersecurity researchers and industry to identify and address these critical flaws before they can be exploited maliciously.
The vulnerability has been assigned a CVSS v3.1 base score of 7.4 with the vector string (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high confidentiality impact with adjacent network access requirements.
The memory leak could allow attackers to gain access to sensitive information stored in the ICU’s memory space, potentially compromising the security of entire industrial control networks.
| Risk Factors | Details |
| Affected Products | All versions of the ICU tool prior to 6.9.5 |
| Impact | Memory leakage |
| Exploit Prerequisites | Physical or logical access to the same network segment as the ICU Tool, ability to send crafted requests to the unpatched utility without authentication |
| CVSS 3.1 Score | 7.4 (High) |
CISA Recommendations
This latest advisory represents part of CISA’s ongoing commitment to industrial control systems security, which the agency identifies as “one of CISA’s top priorities”.
Recent months have seen multiple ICS advisories addressing vulnerabilities in major industrial equipment manufacturers, including Siemens, Schneider Electric, and ABB hardware, with particular concerns about SQL injection vulnerabilities and improper authentication mechanisms.
As CISA notes, “the only way the nation can permanently shift the cybersecurity advantage to ICS cyber defenders is through collective action”.
CISA recommends implementing defense-in-depth strategies, including network segmentation, VPN protection for remote access, and regular security assessments to minimize exploitation risks.
Try in-depth sandbox malware analysis for your SOC team. Get ANY.RUN special offer only until May 31 -> Try Here
