CVE-2026-21656

8.8 highEPSS 0.4%

High (8.8) in johnsoncontrols frick controls quantum hd firmware. EPSS 0.4% chance of exploitation in the next 30 days.

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2026-02-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

johnsoncontrols:frick_controls_quantum_hd_firmware

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Check your stack JSON