Loading vulnerability…
Unauthenticated Remote Code Execution in Johnson Controls Frick Controls Quantum HD
CVE-2026-21658 is a code injection vulnerability in Johnson Controls Frick Controls Quantum HD version 10.22 and earlier. Insufficient validation of input in certain parameters permits attacker-controlled input to trigger unintended code execution before authentication. A remote attacker can exploit the vulnerability without credentials or user interaction, compromising device integrity and availability. The affected parameters and vulnerable function have not been identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated remote code execution on an affected device, potentially enabling unauthorized changes to device behavior and disruption of operations. The vulnerability is rated Critical with a CVSS v3.1 score of 9.1, reflecting high integrity and availability impacts; a confidentiality impact is not established.
If you can’t patch tonight, do this now.
Minimize network exposure of affected devices and prevent direct internet access. Place control-system networks and remote devices behind firewalls, isolate them from business networks, and restrict access to authorized systems. Where remote access is necessary, use a maintained and updated VPN. Perform an operational impact analysis and risk assessment before deploying defensive changes.
Patch, then assume compromise.
Apply a vendor-confirmed fixed release of Frick Controls Quantum HD when available. Versions 10.22 and earlier are affected; a specific fixed version is not identified in the available information. Consult Johnson Controls for the applicable update and deployment guidance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.