CVE-2026-21657 - Vulnerability Analysis

Overview

Johnson Controls Frick Controls Quantum HD <= 10.22 contains a code injection caused by insufficient input validation in certain parameters, letting attackers inject code before authentication, exploit requires no authentication.

Severity & Score

Impact

Attackers can inject code before authentication, potentially compromising device security and control.

Mitigation

Update to a version later than 10.22 or the latest available version.

References

• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner