CVE-2026-21657
Published: 27 February 2026
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication…
more
occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly addresses the root cause of CVE-2026-21657 by requiring comprehensive input validation to prevent code injection from insufficiently validated parameters.
SI-2 ensures timely patching and flaw remediation as outlined in the vendor and CISA advisories, preventing exploitation of the code injection vulnerability in affected versions.
AC-14 limits permitted actions without authentication, mitigating pre-authentication code injection that impacts device security via unexpected actions on unauthenticated inputs.
Security SummaryAI
CVE-2026-21657 is an Improper Control of Generation of Code ('Code Injection') vulnerability, classified under CWE-94, in Johnson Controls Frick Controls Quantum HD. The flaw arises from insufficient validation of input in certain parameters, which may permit unexpected actions that impact the security of the device before authentication occurs. This issue affects Frick Controls Quantum HD version 10.22 and prior versions.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation enables code injection, resulting in high impacts to confidentiality, integrity, and availability of the affected device.
Mitigation details are outlined in the CISA ICS Advisory ICSA-26-057-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01) and the Johnson Controls security advisory (https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories).
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a pre-authentication code injection flaw in a network-accessible ICS device, directly enabling exploitation of a public-facing application.