Pre-authentication RCE and information disclosure flaws in Johnson Controls Frick Quantum HD

CISA published an ICS advisory warning that Johnson Controls Frick Controls Quantum HD (versions 10.22 and earlier) contains multiple vulnerabilities that can be exploited before authentication, enabling remote code execution (RCE), information leakage, and potentially denial of service in environments where the product is deployed (noted as worldwide, including Food and Agriculture critical infrastructure). CISA lists a CVSS v3.1 base score of 9.1 (Critical) for the issue set and attributes the root cause across several items to insufficient input validation in device parameters.

The disclosed CVEs include CVE-2026-21654 (OS command injection, CWE-78) and several code injection RCE issues (CVE-2026-21656, CVE-2026-21657, CVE-2026-21658, CWE-94) that could allow unexpected actions and system compromise without credentials. CVE-2026-21659 describes local file inclusion (LFI) (CWE-23) leading to unauthenticated RCE and information disclosure, explicitly stating an attacker could execute arbitrary code and achieve full system compromise on affected devices. The advisory also references an additional CVE (CVE-2026-21660) not detailed in the other provided entries, indicating the exposure spans more than the five CVE records included here.