CVE-2026-21658 - Vulnerability Analysis

Overview

Johnson Controls Frick Controls Quantum HD <= 10.22 contains a code injection vulnerability caused by improper control of code generation, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise.

Mitigation

Update to a version later than 10.22 or the latest available version.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 2, 2026

🔴 CVE-2026-21658 - Critical (9.8) Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21658/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner