Threat reportICS/SCADATL-2026-3571
CVE-2026-21660: Hardcoded Credentials in Johnson Controls Frick Controls Quantum HD Industrial Refrigeration Controller
CVE-2026-21660 (TL-2026-3571), also tracked as ICSA-26-057-01, is a medium-severity ICS/SCADA threat scored CVSS 6.2, first published 2026-10-15. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21660), maps to 4 MITRE ATT&CK techniques (T0859, T1078, T1078.001), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 6.2/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3571
- Threat ID
- TL-2026-3571
- Also known as
- ICSA-26-057-01, JCI-PSA-2026-05
- Severity
- MEDIUM
- CVSS
- 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Status
- MONITORING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food and agriculture, cold storage, industrial refrigeration, manufacturing
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 7
How CVE-2026-21660 works
CVE-2026-21660 is a hardcoded-credential weakness (CWE-256, plaintext storage of a password) in the firmware of Johnson Controls Frick Controls Quantum HD, rated CVSS 6.2 MEDIUM by CISA. It can enable unauthorized access, sensitive information exposure and system misuse; affected versions are end-of-support legacy platforms and the fix is an upgrade to Quantum HD Unity 12 or higher.
CVE-2026-21660 affects the Frick Controls Quantum HD, an industrial refrigeration controller from Johnson Controls used in food and agriculture and other cold-chain environments. Hardcoded email credentials are stored as plaintext in the device firmware (CWE-256 per the CVE.org CNA record; Burns & McDonnell's advisory summary labels the issue hardcoded credentials, CWE-798). Because the credentials are embedded in the firmware image they cannot be rotated through normal administrative procedures, so every device running an affected firmware carries the exposure for the life of the installation.
CISA advisory ICSA-26-057-01 (released 2026-02-26) rates the flaw CVSS v3.1 6.2 MEDIUM with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (local attack vector, high confidentiality impact, no integrity or availability impact). The CVE.org CNA record carries a CVSS v4.0 score of 6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). One NVD page fetch returned a 9.8 v3.1 score; that conflicts with the CISA and CNA data and was not adopted. The advisory describes impact as unauthorized access, exposure of sensitive information, and potential misuse or system compromise. An attacker who recovers the credentials, for example by extracting and reverse engineering the firmware, could obtain persistent authenticated access to any affected device (Burns & McDonnell analysis).
The issue was reported by Noam Moshe of Claroty Team82 and is one of six Quantum HD CVEs disclosed together: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection, 9.1 each), CVE-2026-21659 (CWE-23 relative path traversal, 7.5) and CVE-2026-21660 (6.2). The first five are described as pre-authentication issues. Claroty lists affected versions as 10.22 through 11, while CISA and CVE.org state 10.22 and prior; both are recorded here. CISA reported no known public exploitation as of the advisory date, and no public PoC, network IOCs or malware are documented in the sources.
Johnson Controls states the affected versions are legacy platforms that have reached end of support and recommends upgrading to Quantum HD Unity version 12 or higher, then verifying compliance with the hardening guide and applying all recommended security configurations (Johnson Controls Product Security Advisory JCI-PSA-2026-05). Defenders should treat these controllers as sensitive OT assets: restrict network and physical/local access, keep them off the internet, and monitor for unexpected logins and firmware extraction attempts.
MITRE ATT&CK techniques used in TL-2026-3571
Persistence
Initial Access
T1078 Valid Accounts; T1078.001 Valid Accounts: Default Accounts
Credential Access
Affected products and versions in CVE-2026-21660
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 through 11 (Claroty Team82); 10.22 and prior (CISA, CVE.org)
Fixed in: Quantum HD Unity 12 or higher
Remediation for CVE-2026-21660
Patches
- Upgrade to Quantum HD Unity version 12 or higher per Johnson Controls Product Security Advisory JCI-PSA-2026-05 and the Quantum HD Unity Software Update Procedure
Immediate actions
- Inventory Frick Controls Quantum HD controllers running firmware 10.22 through 11 and isolate them from the internet and untrusted networks
- Restrict local, physical and engineering-workstation access to the controllers to authorized personnel
- Monitor for unexpected authenticated sessions and firmware/file extraction from these devices
Workarounds
- No vendor workaround is stated in the sources; apply network segmentation and access restriction until upgrade
Longer-term hardening
- Replace end-of-support Quantum HD platforms with Quantum HD Unity 12 or higher
- Segment refrigeration control systems from IT networks and enforce least-privilege remote access
- Verify compliance with the Johnson Controls hardening guide and apply all recommended security configurations
CVEs associated with CVE-2026-21660
Weaknesses (CWE) in CVE-2026-21660
Timeline of CVE-2026-21660
- CVE-2026-21660 identifier reserved (CVE.org record)
- Johnson Controls Product Security Advisory JCI-PSA-2026-05 recommends upgrading to Quantum HD Unity 12 or higher
- CISA releases ICS advisory ICSA-26-057-01 covering six Frick Controls Quantum HD CVEs including CVE-2026-21660 (CVSS v3.1 6.2)
- Claroty Team82 lists CVE-2026-21660 on its disclosure dashboard; affected range given as 10.22 through 11 (end-of-support legacy platforms)
- CVE-2026-21660 published to CVE.org/NVD with CWE-256 and CVSS v4.0 6.9; credited to Noam Moshe of Claroty Team82
- CVE.org record for CVE-2026-21660 last updated
Sources cited for CVE-2026-21660
- Claroty Team82 Disclosure Dashboard: CVE-2026-21660
- CISA ICS Advisory ICSA-26-057-01: Johnson Controls Frick Controls Quantum HD
- CVE.org record for CVE-2026-21660
- NVD: CVE-2026-21660
- Johnson Controls Security Advisories
- Burns & McDonnell 1898 Advisories: Critical pre-authentication vulnerabilities in Frick Controls Quantum HD
- GCVE: CVE-2026-21660
Detection coverage for TL-2026-3571
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3571 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.