iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.

OS command injection in iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, Edge G2 versions 6.9.2 and prior web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware. This is fixed in versions 6.9.3 and newer. iSTAR Ultra and Ultra SE versions 6.9.2 and prior performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Versions 6.9.3 and newer reduce the risk of this vulnerability. There is a default ‘root' password for iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, Edge G2 versions 6.9.2 and prior which can be changed through the command shell. iSTAR Ultra and Ultra SE Versions 6.9.3 and newer reduces the risk of this vulnerability. iSTAR Ultra G2, Ultra G2 SE and Edge G2 version 6.9.3 and newer fixes this vulnerability. There is an undocumented RJ11 serial console on the iSTAR GCM (General Controller Module) which provides access to Uboot. On older firmware versions, an attacker with physical access to this console can get direct access to a shell with ‘root' privileges. In firmware Version 6.8.1 or newer, the console is disabled once the system has fully booted, however the console may be re-enabled due to lack of protection of the Uboot bootloader. USB ports on the GCM board are typically used to connect an ACM (Access Control Module) board. The ACM is what reads badge data, ‘push to exit' signals, fire alar…