# CVE-2026-21660: Hardcoded Credentials in Johnson Controls Frick Controls Quantum HD Industrial Refrigeration Controller

> CVE-2026-21660 is a hardcoded-credential weakness (CWE-256, plaintext storage of a password) in the firmware of Johnson Controls Frick Controls Quantum HD, rated CVSS 6.2 MEDIUM by CISA. It can enable unauthorized access, sensitive information exposure and system misuse; affected versions are end-of-support legacy platforms and the fix is an upgrade to Quantum HD Unity 12 or higher.

- **Published:** 2026-10-15T00:55:18Z
- **Last reviewed:** 2026-10-15T00:55:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3571
- **ID:** TL-2026-3571
- **Severity:** MEDIUM (CVSS 6.2)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21660

## Description

CVE-2026-21660 affects the Frick Controls Quantum HD, an industrial refrigeration controller from Johnson Controls used in food and agriculture and other cold-chain environments. Hardcoded email credentials are stored as plaintext in the device firmware (CWE-256 per the CVE.org CNA record; Burns & McDonnell's advisory summary labels the issue hardcoded credentials, CWE-798). Because the credentials are embedded in the firmware image they cannot be rotated through normal administrative procedures, so every device running an affected firmware carries the exposure for the life of the installation.

CISA advisory ICSA-26-057-01 (released 2026-02-26) rates the flaw CVSS v3.1 6.2 MEDIUM with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (local attack vector, high confidentiality impact, no integrity or availability impact). The CVE.org CNA record carries a CVSS v4.0 score of 6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). One NVD page fetch returned a 9.8 v3.1 score; that conflicts with the CISA and CNA data and was not adopted. The advisory describes impact as unauthorized access, exposure of sensitive information, and potential misuse or system compromise. An attacker who recovers the credentials, for example by extracting and reverse engineering the firmware, could obtain persistent authenticated access to any affected device (Burns & McDonnell analysis).

The issue was reported by Noam Moshe of Claroty Team82 and is one of six Quantum HD CVEs disclosed together: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection, 9.1 each), CVE-2026-21659 (CWE-23 relative path traversal, 7.5) and CVE-2026-21660 (6.2). The first five are described as pre-authentication issues. Claroty lists affected versions as 10.22 through 11, while CISA and CVE.org state 10.22 and prior; both are recorded here. CISA reported no known public exploitation as of the advisory date, and no public PoC, network IOCs or malware are documented in the sources.

Johnson Controls states the affected versions are legacy platforms that have reached end of support and recommends upgrading to Quantum HD Unity version 12 or higher, then verifying compliance with the hardening guide and applying all recommended security configurations (Johnson Controls Product Security Advisory JCI-PSA-2026-05). Defenders should treat these controllers as sensitive OT assets: restrict network and physical/local access, keep them off the internet, and monitor for unexpected logins and firmware extraction attempts.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078.001 Valid Accounts: Default Accounts
- T1552.001 Unsecured Credentials: Credentials In Files
- T0859 Valid Accounts

## Sources

- [Claroty Team82 Disclosure Dashboard: CVE-2026-21660](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-21660)
- [CISA ICS Advisory ICSA-26-057-01: Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [CVE.org record for CVE-2026-21660](https://cveawg.mitre.org/api/cve/CVE-2026-21660)
- [NVD: CVE-2026-21660](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-21660)
- [Johnson Controls Security Advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Burns & McDonnell 1898 Advisories: Critical pre-authentication vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [GCVE: CVE-2026-21660](https://db.gcve.eu/vuln/CVE-2026-21660)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3571