CVE-2026-21657 - Vulnerability Analysis

Overview

Johnson Controls Frick Controls Quantum HD <= 10.22 contains a code injection caused by insufficient input validation in certain parameters, letting attackers inject code before authentication, exploit requires no authentication.

Severity & Score

Impact

Attackers can inject code before authentication, potentially compromising device security and control.

Mitigation

Update to a version later than 10.22 or the latest available version.

References

• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 2, 2026

🔴 CVE-2026-21657 - Critical (9.8) Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21657/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner