CVE-2026-21658
Published: 27 February 2026
Description
Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security…
more
of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the code injection vulnerability by requiring comprehensive input validation at affected parameters to prevent unexpected code execution.
Ensures timely patching and remediation of the specific unauthenticated RCE flaw in Quantum HD version 10.22 and prior, as outlined in vendor advisories.
Limits and documents permitted unauthenticated actions to prohibit those enabling code injection and security impacts prior to authentication.
Security SummaryAI
CVE-2026-21658 is an unauthenticated remote code execution vulnerability stemming from improper control of code generation, classified as a code injection issue (CWE-94), in Johnson Controls Frick Controls Quantum HD. The flaw arises from insufficient validation of input in certain parameters, enabling unexpected actions that compromise device security prior to authentication. It affects Quantum HD version 10.22 and prior versions, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Attackers require no privileges or user interaction and can exploit the vulnerability remotely over the network with low complexity. Successful exploitation grants full remote code execution, potentially allowing high-impact disruption to confidentiality, integrity, and availability of the affected device.
Mitigation details are outlined in the CISA ICS advisory ICSA-26-057-01 and Johnson Controls security advisories, available at the respective reference URLs. Security practitioners should consult these for patching instructions and workarounds.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote code execution in a network-accessible industrial control system device via code injection in parameters, directly enabling exploitation of a public-facing application.