CVE-2026-21654 - Vulnerability Analysis

Overview

Johnson Controls Frick Controls Quantum HD <= 10.22 contains an OS command injection caused by improper neutralization of special elements, letting attackers execute arbitrary OS commands remotely, exploit requires network access.

Severity & Score

Impact

Attackers can execute arbitrary OS commands, potentially leading to full system compromise.

Mitigation

Update to a version later than 10.22 or the latest available version.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 2, 2026

🔴 CVE-2026-21654 - Critical (9.8) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21654/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner