ByteOS Network

CVE Vulnerability Details :

CVE-2026-21654

PUBLISHED

More Info Official Page

Assigner-jci

Assigner Org ID-7281d04a-a537-43df-bfb4-fa4110af9d01

Published At-27 Feb, 2026 | 08:38

Updated At-27 Feb, 2026 | 09:24

▼CVE Numbering Authority (CNA)

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

Affected Products

Vendor

Johnson Controls

Product

Frick Controls Quantum HD

Default Status

unaffected

Versions

Affected

Frick Controls Quantum HD version 10.22 and prior

Problem Types

Type	CWE ID	Description
CWE	CWE-78	CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Type: CWE

CWE ID: CWE-78

Description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Metrics

Version	Base score	Base severity	Vector
4.0	8.8	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Version: 4.0

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Impacts

CAPEC ID	Description
CAPEC-88	CAPEC-88 OS Command Injection

CAPEC ID: CAPEC-88

Description: CAPEC-88 OS Command Injection

Solutions

a. Quantum HD version 10.22 through Version 11 is a previous product platform and is End Of support platform and should be upgraded to new platform with Quantum HD Unity version 12 and above. The update procedure can be found here: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Credits

finder

Noam Moshe of Claroty Team 82 Research group

References

Hyperlink	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01	N/A
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories	N/A

Hyperlink: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01

Resource: N/A

Hyperlink: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Resource: N/A

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References