High severity · published Dec 17, 2025
CVE-2025-61736
iSTAR- Improper Validation of Certificate Expiration
7.1
CVSS
0.1%
EPSS
No
On KEV
Description
Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
II
iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE · Johnson Controls
iSTAR All versions prior to TLS 1.2 · source: vendor
Affected product
II
iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE
Johnson Controls