# CVE-2026-21660: Hardcoded Credentials in Johnson Controls Frick Controls Quantum HD Industrial Refrigeration Controller

> CVE-2026-21660 is a hardcoded-credential flaw (plaintext email credentials embedded in firmware) in the legacy Johnson Controls Frick Controls Quantum HD controller, disclosed by Claroty Team82 via CISA ICSA-26-057-01. It can expose sensitive information and enable unauthorized access; the fix is migration to Quantum HD Unity 12 or later.

- **Published:** 2026-10-24T06:27:06Z
- **Last reviewed:** 2026-10-24T06:27:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4350
- **ID:** TL-2026-4350
- **Severity:** MEDIUM (CVSS 6.2)
- **Category:** ICS_SCADA
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21660

## Description

CVE-2026-21660 affects the Frick Controls Quantum HD, an industrial refrigeration controller used in food and agriculture environments (cold storage, food processing). Email credentials used by the device for notification or reporting functions are stored as plaintext inside the firmware. Anyone able to obtain or inspect the firmware image or the device's local data can recover these credentials. The CVE record classifies the weakness as CWE-256 (Plaintext Storage of a Password), with CWE-522 (Insufficiently Protected Credentials) also listed, and CAPEC-37 (Retrieve Embedded Sensitive Data). Per CISA, the impact is unauthorized access, exposure of sensitive information, and potential misuse or system compromise.

The CISA ICS advisory (ICSA-26-057-01, released 2026-02-26) rates the issue CVSS v3.1 6.2 MEDIUM (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); the CVE record carries a CVSS v4.0 score of 6.9 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). The local attack vector and confidentiality-only impact distinguish it from the other five CVEs in the same advisory (CVE-2026-21654, -21656, -21657, -21658 and -21659), which are pre-authentication injection, code-execution and path-traversal flaws rated 7.5-9.1. The Claroty Team82 dashboard lists affected versions as 10.22 through 11, while CISA and the CVE record state 10.22 and prior; defenders should treat every pre-Unity Quantum HD release as in scope. The product is legacy and end of support.

The issue was reported by Noam Moshe of Claroty Team82. CISA states it has received no reports of known public exploitation, and no public PoC or in-the-wild activity is documented in the sources reviewed. No network indicators (IPs, domains, hashes) are published, and no named threat actor is associated with it. Johnson Controls recommends upgrading to Quantum HD Unity version 12 or higher, then verifying the deployment against the hardening guide and applying the recommended security configurations (vendor advisory JCI-PSA-2026-05). Where upgrade is not immediately possible, isolate controllers on dedicated OT network segments, restrict remote access, and rotate/restrict the associated email account since its credential should be assumed exposed.

## MITRE ATT&CK

- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1078 Valid Accounts
- T1078.001 Default Accounts
- T1005 Data from Local System
- T0859 Valid Accounts

## Sources

- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-21660](https://claroty.com/team82/disclosure-dashboard/cve-2026-21660)
- [CVE Record - CVE-2026-21660](https://cveawg.mitre.org/api/cve/CVE-2026-21660)
- [NVD - CVE-2026-21660](https://nvd.nist.gov/vuln/detail/CVE-2026-21660)
- [Johnson Controls Product Security Advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Burns & McDonnell 1898 Advisories - Critical pre-authentication vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [SentinelOne Vulnerability Database - CVE-2026-21660](https://www.sentinelone.com/vulnerability-database/cve-2026-21660/)
- [Rewterz Threat Advisory - ICS: Multiple Johnson Controls Frick Controls Quantum HD Vulnerabilities](https://rewterz.com/threat-advisory/ics-multiple-johnson-controls-frick-controls-quantum-hd-vulnerabilities)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4350