Skip to navigation

Threat reportVulnerabilityTL-2026-5917

CVE-2026-21660 - Hardcoded credentials in Johnson Controls Frick Controls Quantum HD industrial refrigeration controller

mediumPATCHED

Claroty Team82 (Noam Moshe) reported hardcoded/plaintext-stored credentials in Johnson Controls Frick Controls Quantum HD firmware 10.22 and earlier, tracked as CVE-2026-21660 (CVSS 3.1 base 6.2) and published in CISA advisory ICSA-26-057-01. Abuse could lead to unauthorized access and exposure of sensitive information; the fix is an upgrade to Quantum HD Unity v12 or later. First disclosed .

Key facts

IdentifiersTL-2026-5917, CVE-2026-21660
Also known asICSA-26-057-01, JCI-PSA-2026-05
SeverityMEDIUM
CVSS6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
First disclosed
EPSSCVE-2026-21660: 0.2% (18.2th percentile)
Affected productsJohnson Controls Frick Controls Quantum HD
Weaknesses (CWE)CWE-256, CWE-798
ToolsFrick Controls Quantum HD, Quantum HD Unity
MITRE ATT&CK techniquesT1005 Data from Local System, T1078.001 Default Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1552.001 Credentials In Files
MotivationUNKNOWN
Target sectorsfood and agriculture, industrial refrigeration, cold storage, manufacturing
Target regionsWorldwide
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5917 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Quantum HD Hardcoded-Credential Login From Unapproved Source (CVE-2026-21660)

Flags successful login-style POST requests to Johnson Controls Frick Controls Quantum HD controllers (firmware 10.22 and earlier) from sources not on the approved admin allowlist. CVE-2026-21660 embeds static credentials that cannot be rotated, so an authenticated session from an unexpected host is the primary observable of abuse (ICSA-26-057-01, JCI-PSA-2026-05).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1078.001, T1078, T1133
  • Data sources: zeek_http (index=zeek sourcetype=bro:http:json), zeek_conn (index=zeek sourcetype=bro:conn:json)
  • Severity: high
  • Confidence: medium

Splunk SPL

index=zeek sourcetype="bro:http:json" earliest=-24h [| inputlookup quantum_hd_assets.csv | rename ip AS "id.resp_h" | fields "id.resp_h"] NOT [| inputlookup quantum_hd_admin_sources.csv | rename ip AS "id.orig_h" | fields "id.orig_h"] method=POST (uri="*login*" OR uri="*auth*" OR uri="*session*") status_code IN (200,301,302) | rename "id.orig_h" AS src_ip, "id.resp_h" AS dest_ip | stats count AS attempts min(_time) AS first_seen max(_time) AS last_seen values(uri) AS uris values(user_agent) AS user_agents BY src_ip, dest_ip | convert ctime(first_seen) ctime(last_seen) | table first_seen last_seen src_ip dest_ip attempts uris user_agents

Microsoft KQL

let assets = _GetWatchlist('QuantumHD_Assets') | project SearchKey;
let admins = _GetWatchlist('QuantumHD_AdminSources') | project SearchKey;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (assets) and SourceIP !in (admins)
| where RequestMethod =~ "POST" and RequestURL matches regex @"(?i)(login|auth|session)"
| where DeviceAction !in~ ("deny","drop","block","blocked","denied","reset")
| summarize Attempts=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Urls=make_set(RequestURL, 10) by SourceIP, DestinationIP, DeviceVendor
| project FirstSeen, LastSeen, SourceIP, DestinationIP, Attempts, Urls, DeviceVendor

Sigma

title: Successful Login to Quantum HD Controller From Non-Internal Source (CVE-2026-21660)
id: 3b7e1a52-8c4d-4f60-9a1e-5917a0000001
status: experimental
description: Detects successful POST authentication requests to login, auth or session paths from outside private address space, a proxy for hardcoded credential abuse (CVE-2026-21660) against Frick Controls Quantum HD. Sigma cannot consume an asset allowlist, so scope by destination in the backend.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://fr.claroty.com/team82/disclosure-dashboard/cve-2026-21660
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial_access
    - attack.persistence
    - attack.t1078.001
    - attack.t1133
    - cve.2026.21660
logsource:
    product: zeek
    service: http
detection:
    selection:
        method: 'POST'
        uri|contains:
            - 'login'
            - 'auth'
            - 'session'
        status_code:
            - 200
            - 301
            - 302
    filter_internal:
        id.orig_h|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Remote vendor support sessions via VPN or NAT
    - Cloud hosted monitoring or historian polling
level: medium

Known false positives:

  • Approved engineering workstation not yet listed in quantum_hd_admin_sources.csv
  • Vendor remote-support session through a jump host

Tuning notes: Populate quantum_hd_assets.csv and quantum_hd_admin_sources.csv (column: ip). The login URI paths and status codes are assumptions; confirm them against real Quantum HD web traffic and adjust. Several unique successful sources within an hour warrant escalation.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Quantum HD Web Interface Traversal or Command-Injection Attempt (ICSA-26-057-01) · unlock with TL Creds
  • Quantum HD Bulk Data or Firmware Download by Unapproved Host · unlock with TL Creds
  • Quantum HD Controller Initiating Remote-Admin Connections to Internal Hosts · unlock with TL Creds
  • Authenticated Session to Quantum HD Web Interface From Public Source · unlock with TL Creds
  • Quantum HD Sensitive File Read via Path Traversal (CVE-2026-21659 and CVE-2026-21660 Chain) · unlock with TL Creds
  • Public-Source Inbound Access to Quantum HD OT Segment · unlock with TL Creds
  • Quantum HD Configuration or Firmware Artifact Retrieval by Unapproved Host · unlock with TL Creds
  • Quantum HD Controller Outbound Connection to Public Internet · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5917.

Sample indicators (2 of 9)

  • URL: hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-057-01
  • URL: hxxps://fr[.]claroty[.]com/team82/disclosure-dashboard/cve-2026-21660

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

9 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

CVE-2026-21660 affects the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller used in the Food and Agriculture sector worldwide. Versions 10.22 through 11 are legacy platforms that have reached end of support. CISA ICSA-26-057-01 (released 2026-02-26) rates the flaw CVSS 3.1 6.2 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and maps it to CWE-256 (Plaintext Storage of a Password). Claroty Team82 and 1898 & Co. describe it as hardcoded credentials (CWE-798) embedded in the firmware.

According to the 1898 & Co. analysis, the embedded credentials cannot be rotated through standard administrative procedures, so exposure persists for the life of an unpatched installation. An attacker who obtains the credentials, for example through firmware reverse engineering or prior disclosure, could authenticate to an affected device without alerting operators. Per 1898 & Co., this path persists even if injection flaws are mitigated with input filtering or WAF controls.

The same CISA advisory covers five other Quantum HD vulnerabilities reported by the same researcher: CVE-2026-21654 (OS command injection, CVSS 9.1), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (code injection, CVSS 9.1 each), and CVE-2026-21659 (relative path traversal, CVSS 7.5). Per CISA and 1898 & Co., these allow pre-authentication remote code execution, information leak or denial of service. Those CVEs are distinct from CVE-2026-21660 but share the same affected product and fix.

CISA states that no known public exploitation specifically targeting these vulnerabilities had been reported to it at the time of publication. No public PoC, threat actor attribution or network indicators are published in the sources reviewed. Vendor remediation is to upgrade to Quantum HD Unity v12 or higher and verify compliance with the hardening guide (Johnson Controls Product Security Advisory JCI-PSA-2026-05). Third-party aggregators disagree on the score (a CVSS 4.0 value of 6.9 and a 9.8 v3 value appear on some trackers); this record uses the CISA-published 6.2.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Initial Access

T1078.001 Default Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1078.001 Default Accounts

Privilege Escalation

T1078.001 Default Accounts

Credential Access

T1552.001 Credentials In Files

Remediation

Patches

  • Upgrade to Quantum HD Unity version 12 or higher per the vendor Software Update Procedure (Johnson Controls advisory JCI-PSA-2026-05)

Immediate actions

  • Identify all Frick Controls Quantum HD controllers running firmware 10.22 and earlier and inventory them
  • Isolate controllers on dedicated OT segments behind industrial firewalls, away from IT networks, remote access paths and the internet
  • Audit for internet-reachable Quantum HD devices, isolate them first, and log access attempts during the unpatched window

Workarounds

  • No credential rotation is possible through standard administrative procedures; rely on network isolation until upgraded
  • After upgrading, verify compliance with the hardening guide, apply recommended security configurations, and confirm hardcoded credentials are remediated

Longer-term hardening

  • Deploy OT network monitoring for anomalous HTTP traffic, unexpected command execution and new outbound connections
  • Retire end-of-support Quantum HD platforms (10.22 through 11) in favor of supported Quantum HD Unity
  • Require VPN with strong MFA for any remote access to control system networks

Affected and fixed versions

  • Johnson Controls — Frick Controls Quantum HD
    Vulnerable versions: 10.22 and earlier; 10.22 through 11 (legacy, end of support)
    Fixed in: Quantum HD Unity 12 or higher

Timeline

  • CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to it.
  • CISA credits Noam Moshe of Claroty Team 82 with reporting the Quantum HD vulnerabilities; Claroty lists CVE-2026-21660 as Medium Threat on its disclosure dashboard.
  • Johnson Controls recommends upgrading to Quantum HD Unity v12 or higher (Product Security Advisory JCI-PSA-2026-05); versions 10.22 through 11 are legacy platforms past end of support.
  • CISA releases ICS Advisory ICSA-26-057-01 (Revision 1) covering six Frick Controls Quantum HD vulnerabilities, including CVE-2026-21660 (CVSS 3.1 6.2, CWE-256).
  • 1898 & Co. publishes analysis noting the embedded credentials cannot be rotated through standard administrative procedures and cites an alternate disclosure date of 2026-02-27.
  • 1898 & Co. advisory page metadata shows a modification date of 2026-04-29.

Sources cited

Other reports on CVE-2026-21660

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats