Loading vulnerability…
Pre-auth OS command injection in Johnson Controls Frick Controls Quantum HD <= 10.22
Information currently not available to provide a detailed, function-level description beyond the provided advisory text. Based on the provided content, CVE-2026-21654 is an OS command injection vulnerability in Johnson Controls Frick Controls Quantum HD caused by insufficient validation of input in certain parameters, enabling unexpected actions and potential security impact prior to authentication. Affected versions are 10.22 and earlier.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Information currently not available to provide a detailed impact assessment beyond the provided content. Based on the provided content, successful exploitation can allow pre-authentication injection/execution of OS commands, with high integrity and availability impact (per provided CVSS vectors), and may enable remote code execution and/or denial of service on affected devices.
If you can’t patch tonight, do this now.
Limit exposure of Quantum HD devices to untrusted networks (do not expose to the public internet), place control system networks/devices behind firewalls, segment/isolate ICS networks from business networks, and use secure remote access (e.g., VPN) that is kept updated, consistent with CISA ICS guidance referenced in the provided content.
Patch, then assume compromise.
Upgrade Johnson Controls Frick Controls Quantum HD to a fixed version newer than 10.22 as provided by the vendor (Johnson Controls).
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.