CVE-2026-21659 - Vulnerability Analysis

Overview

Johnson Controls Frick Controls Quantum HD <= 10.22 contains a local file inclusion vulnerability allowing unauthenticated attackers to execute arbitrary code, leading to full system compromise.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary code, leading to full system compromise.

Mitigation

Update to a version later than 10.22 or the latest available version.

References

• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 2, 2026

🔴 CVE-2026-21659 - Critical (9.8) Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, lea... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21659/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner