CVE-2026-21657
Published: 27 February 2026
Summary
CVE-2026-21657 is a high-severity Code Injection (CWE-94) vulnerability in Johnsoncontrols Frick Controls Quantum Hd Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21657 is an Improper Control of Generation of Code ('Code Injection') vulnerability, classified under CWE-94, in Johnson Controls Frick Controls Quantum HD. The flaw arises from insufficient validation of input in certain parameters, which may permit unexpected actions that impact the security of the device before authentication occurs. This issue affects Frick Controls Quantum HD version 10.22 and prior versions.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation enables code injection, resulting in high impacts to confidentiality, integrity, and availability of the affected device.
Mitigation details are outlined in the CISA ICS Advisory ICSA-26-057-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01) and the Johnson Controls security advisory (https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9012
Vulnerability details
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication…
more
occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a pre-authentication code injection flaw in a network-accessible ICS device, directly enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly addresses the root cause of CVE-2026-21657 by requiring comprehensive input validation to prevent code injection from insufficiently validated parameters.
SI-2 ensures timely patching and flaw remediation as outlined in the vendor and CISA advisories, preventing exploitation of the code injection vulnerability in affected versions.
AC-14 limits permitted actions without authentication, mitigating pre-authentication code injection that impacts device security via unexpected actions on unauthenticated inputs.