Loading vulnerability…
Pre-auth code injection in Johnson Controls Frick Controls Quantum HD (<= 10.22)
CVE-2026-21656 is an improper control of generation of code (code injection) vulnerability in Johnson Controls Frick Controls Quantum HD. The issue is caused by insufficient validation of input in certain parameters, which may allow an unauthenticated remote attacker to supply crafted input that triggers unexpected actions prior to authentication, impacting the security of the device. Affected versions are Quantum HD 10.22 and earlier.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may enable pre-authentication code injection leading to unexpected actions on the device, with high integrity and availability impact (per referenced scoring), potentially resulting in device compromise and/or denial of service conditions.
If you can’t patch tonight, do this now.
Restrict network exposure of the Quantum HD interface (do not expose to the internet), enforce network segmentation/ICS zoning, and limit access to trusted hosts via firewall/ACLs and/or VPN for remote access; monitor for suspicious requests targeting vulnerable parameters.
Patch, then assume compromise.
Upgrade Johnson Controls Frick Controls Quantum HD to a fixed version newer than 10.22 as provided by the vendor (Johnson Controls security advisories / CISA ICS advisory).
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.