CVE-2024-32752
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceiSTAR door controllers running firmware versions prior to 6.6.B do not implement authentication for communications with the ICU (Intelligent Control Unit), potentially allowing unauthenticated attackers to intercept or inject commands into the physical access control system communications and gain unauthorized access.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify iSTAR controller firmware versionAccess the iSTAR door controller web interface or administrative console and navigate to the firmware/version information section. Alternatively, use the controller's CLI or management software to retrieve the firmware version string.Affected if The displayed firmware version is any build prior to 6.6.B (for example, 6.5.x, 6.4.x, or earlier).
-
Verify ICU communication is enabledIn the iSTAR controller web interface, check the ICU (Intelligent Control Unit) configuration settings or status page. Look for fields related to ICU connectivity, communication mode, or network settings that indicate whether ICU communication is active.Affected if ICU communication is enabled and the controller is actively communicating with an ICU on the network.
-
Check network accessibility of the controllerFrom a workstation on the same network segment as the iSTAR controller, attempt to reach the controller's management interface IP address using ping or port scanning tools (for example, nmap). Identify open ports associated with ICU communication (typically ports used by the controller's proprietary protocol).Affected if The controller's ICU communication ports are exposed to network segments that are not restricted by firewall rules or VLAN segmentation.
-
Confirm lack of authentication configurationIn the ICU management interface or controller settings, locate the communication security or authentication settings. Verify whether there is an option for authenticated communication or a shared secret/key configured between the controller and ICU.Affected if No authentication mechanism (such as a shared key or TLS with authentication) is configured for ICU-controller communications, and the communication mode is set to unencrypted or unauthenticated.
You are affected if your iSTAR door controller runs firmware versions before 6.6.B and has ICU communication enabled without authentication configured.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade iSTAR door controller firmware to version 6.6.B or later which adds authenticated communications support. If immediate upgrade is not possible, network segment the controllers and restrict access to ICU management interfaces.
iSTAR door controller firmware version 6.6.B or later
- 1. Identify all iSTAR door controllers in your environment that need to be assessed for this vulnerability
- 2. Access each iSTAR controller's management interface or use the appropriate management tool to check the current firmware version
- 3. For controllers running firmware versions prior to 6.6.B, obtain the firmware version 6.6.B or later from Johnson Controls
- 4. Following Johnson Controls' documented firmware upgrade procedures, upgrade each affected iSTAR controller to firmware version 6.6.B or later
- 5. After upgrade, verify the controller is running the new firmware version and that authenticated communications with ICU are now supported
- 6. Confirm the vulnerability is remediated by verifying that unauthenticated access is no longer possible
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation2.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-32752 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-32752 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data