# CVE-2026-21660 - Hardcoded credentials in Johnson Controls Frick Controls Quantum HD industrial refrigeration controller

> Claroty Team82 (Noam Moshe) reported hardcoded/plaintext-stored credentials in Johnson Controls Frick Controls Quantum HD firmware 10.22 and earlier, tracked as CVE-2026-21660 (CVSS 3.1 base 6.2) and published in CISA advisory ICSA-26-057-01. Abuse could lead to unauthorized access and exposure of sensitive information; the fix is an upgrade to Quantum HD Unity v12 or later.

- **Published:** 2026-11-13T02:18:09Z
- **Last reviewed:** 2026-11-13T02:18:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5917
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5917.png
- **ID:** TL-2026-5917
- **Severity:** MEDIUM (CVSS 6.2)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (2 shown free below)
- **CVEs:** CVE-2026-21660

## Description

CVE-2026-21660 affects the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller used in the Food and Agriculture sector worldwide. Versions 10.22 through 11 are legacy platforms that have reached end of support. CISA ICSA-26-057-01 (released 2026-02-26) rates the flaw CVSS 3.1 6.2 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and maps it to CWE-256 (Plaintext Storage of a Password). Claroty Team82 and 1898 & Co. describe it as hardcoded credentials (CWE-798) embedded in the firmware.

According to the 1898 & Co. analysis, the embedded credentials cannot be rotated through standard administrative procedures, so exposure persists for the life of an unpatched installation. An attacker who obtains the credentials, for example through firmware reverse engineering or prior disclosure, could authenticate to an affected device without alerting operators. Per 1898 & Co., this path persists even if injection flaws are mitigated with input filtering or WAF controls.

The same CISA advisory covers five other Quantum HD vulnerabilities reported by the same researcher: CVE-2026-21654 (OS command injection, CVSS 9.1), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (code injection, CVSS 9.1 each), and CVE-2026-21659 (relative path traversal, CVSS 7.5). Per CISA and 1898 & Co., these allow pre-authentication remote code execution, information leak or denial of service. Those CVEs are distinct from CVE-2026-21660 but share the same affected product and fix.

CISA states that no known public exploitation specifically targeting these vulnerabilities had been reported to it at the time of publication. No public PoC, threat actor attribution or network indicators are published in the sources reviewed. Vendor remediation is to upgrade to Quantum HD Unity v12 or higher and verify compliance with the hardening guide (Johnson Controls Product Security Advisory JCI-PSA-2026-05). Third-party aggregators disagree on the score (a CVSS 4.0 value of 6.9 and a 9.8 v3 value appear on some trackers); this record uses the CISA-published 6.2.

## MITRE ATT&CK

- T1078.001 Default Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078.001 Default Accounts
- T1078.001 Default Accounts
- T1552.001 Credentials In Files
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Quantum HD Hardcoded-Credential Login From Unapproved Source (CVE-2026-21660)** (`TL-2026-5917-SPL-001`)

Flags successful login-style POST requests to Johnson Controls Frick Controls Quantum HD controllers (firmware 10.22 and earlier) from sources not on the approved admin allowlist. CVE-2026-21660 embeds static credentials that cannot be rotated, so an authenticated session from an unexpected host is the primary observable of abuse (ICSA-26-057-01, JCI-PSA-2026-05).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078.001, T1078, T1133
- **Data sources:** zeek_http (index=zeek sourcetype=bro:http:json), zeek_conn (index=zeek sourcetype=bro:conn:json)
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=zeek sourcetype="bro:http:json" earliest=-24h [| inputlookup quantum_hd_assets.csv | rename ip AS "id.resp_h" | fields "id.resp_h"] NOT [| inputlookup quantum_hd_admin_sources.csv | rename ip AS "id.orig_h" | fields "id.orig_h"] method=POST (uri="*login*" OR uri="*auth*" OR uri="*session*") status_code IN (200,301,302) | rename "id.orig_h" AS src_ip, "id.resp_h" AS dest_ip | stats count AS attempts min(_time) AS first_seen max(_time) AS last_seen values(uri) AS uris values(user_agent) AS user_agents BY src_ip, dest_ip | convert ctime(first_seen) ctime(last_seen) | table first_seen last_seen src_ip dest_ip attempts uris user_agents
```

### Microsoft KQL

```kql
let assets = _GetWatchlist('QuantumHD_Assets') | project SearchKey;
let admins = _GetWatchlist('QuantumHD_AdminSources') | project SearchKey;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (assets) and SourceIP !in (admins)
| where RequestMethod =~ "POST" and RequestURL matches regex @"(?i)(login|auth|session)"
| where DeviceAction !in~ ("deny","drop","block","blocked","denied","reset")
| summarize Attempts=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Urls=make_set(RequestURL, 10) by SourceIP, DestinationIP, DeviceVendor
| project FirstSeen, LastSeen, SourceIP, DestinationIP, Attempts, Urls, DeviceVendor
```

### Sigma

```yaml
title: Successful Login to Quantum HD Controller From Non-Internal Source (CVE-2026-21660)
id: 3b7e1a52-8c4d-4f60-9a1e-5917a0000001
status: experimental
description: Detects successful POST authentication requests to login, auth or session paths from outside private address space, a proxy for hardcoded credential abuse (CVE-2026-21660) against Frick Controls Quantum HD. Sigma cannot consume an asset allowlist, so scope by destination in the backend.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://fr.claroty.com/team82/disclosure-dashboard/cve-2026-21660
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial_access
    - attack.persistence
    - attack.t1078.001
    - attack.t1133
    - cve.2026.21660
logsource:
    product: zeek
    service: http
detection:
    selection:
        method: 'POST'
        uri|contains:
            - 'login'
            - 'auth'
            - 'session'
        status_code:
            - 200
            - 301
            - 302
    filter_internal:
        id.orig_h|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Remote vendor support sessions via VPN or NAT
    - Cloud hosted monitoring or historian polling
level: medium

```

**Known false positives:**

- Approved engineering workstation not yet listed in quantum_hd_admin_sources.csv
- Vendor remote-support session through a jump host

**Tuning notes:** Populate quantum_hd_assets.csv and quantum_hd_admin_sources.csv (column: ip). The login URI paths and status codes are assumptions; confirm them against real Quantum HD web traffic and adjust. Several unique successful sources within an hour warrant escalation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Quantum HD Web Interface Traversal or Command-Injection Attempt (ICSA-26-057-01) (locked: unlock with TL Creds)
- Quantum HD Bulk Data or Firmware Download by Unapproved Host (locked: unlock with TL Creds)
- Quantum HD Controller Initiating Remote-Admin Connections to Internal Hosts (locked: unlock with TL Creds)
- Authenticated Session to Quantum HD Web Interface From Public Source (locked: unlock with TL Creds)
- Quantum HD Sensitive File Read via Path Traversal (CVE-2026-21659 and CVE-2026-21660 Chain) (locked: unlock with TL Creds)
- Public-Source Inbound Access to Quantum HD OT Segment (locked: unlock with TL Creds)
- Quantum HD Configuration or Firmware Artifact Retrieval by Unapproved Host (locked: unlock with TL Creds)
- Quantum HD Controller Outbound Connection to Public Internet (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 9)

Defanged, TLP:CLEAR.

- URL: `hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-057-01`
- URL: `hxxps://fr[.]claroty[.]com/team82/disclosure-dashboard/cve-2026-21660`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21660](https://fr.claroty.com/team82/disclosure-dashboard/cve-2026-21660)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [1898 & Co. - Johnson Controls: Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD Industrial Refrigeration Controller](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [Johnson Controls - Quantum HD Unity Software Update Procedure](https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf)
- [NVD - CVE-2026-21660](https://nvd.nist.gov/vuln/detail/cve-2026-21660)
- [VulDB - CVE-2026-21660 Frick Controls Quantum HD](https://vuldb.com/cve/CVE-2026-21660)
- [Tenable - CVE-2026-21660](https://www.tenable.com/cve/CVE-2026-21660)
- [Claroty Team82 Coordinated Disclosure Policy](https://web-assets.claroty.com/team82-disclosure-policy.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5917