Loading vulnerability…
Pre-auth code injection in Johnson Controls Frick Controls Quantum HD (<= 10.22)
CVE-2026-21657 is an Improper Control of Generation of Code (Code Injection) vulnerability in Johnson Controls Frick Controls Quantum HD. Insufficient validation of input in certain parameters may allow an attacker to inject code and trigger unexpected actions that impact the security of the device. The issue is reachable before authentication and affects Quantum HD version 10.22 and earlier.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Pre-authentication code injection can enable an unauthenticated remote attacker to perform unexpected actions on the device, with high impact to integrity and availability as reflected in published scoring (e.g., CVSS vectors indicating network-reachable, no privileges, no user interaction, and high I/A impact).
If you can’t patch tonight, do this now.
Until a fixed version can be applied, reduce exposure of the Quantum HD interface: ensure it is not internet-accessible, restrict access to trusted/segmented networks via firewall/ACL allowlisting, and require VPN-only remote access (kept updated). Monitor for suspicious requests targeting the vulnerable parameters.
Patch, then assume compromise.
Upgrade Johnson Controls Frick Controls Quantum HD to a vendor-fixed version newer than 10.22 when available; versions 10.22 and earlier are affected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.