CVE-2026-21658: Pre-Authentication Input Validation / Code Injection Flaw in Johnson Controls Frick Controls Quantum HD (10.22 and earlier, legacy through 11)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5920 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Shell or Download Utility Executed on Frick Controls Quantum HD Controller (Post-Exploitation)

Detects auditd EXECVE records on Quantum HD controller hosts where a shell is launched with -c (typical of a code/command injection reaching system()) or where wget/curl/tftp/netcat are executed. On a hardened refrigeration controller these executions are rare, and following CVE-2026-21658 / CVE-2026-21654 exploitation they indicate attacker command execution.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059, T1059.004, T0807
• Data sources: linux_auditd, linux:audit
• Severity: high
• Confidence: medium

Splunk SPL

index=linux sourcetype="linux:audit" type=EXECVE earliest=-24h (host="*quantum*" OR host="*frick*") ((a0 IN ("sh","/bin/sh","bash","/bin/bash","busybox","/bin/busybox") a1="-c") OR a0 IN ("wget","/usr/bin/wget","curl","/usr/bin/curl","tftp","nc","ncat","/bin/nc")) | eval cmdline=trim(a0." ".coalesce(a1,"")." ".coalesce(a2,"")." ".coalesce(a3,"")) | eval threat="TL-2026-5920 CVE-2026-21658 post-exploitation shell execution" | stats count min(_time) as first_seen max(_time) as last_seen values(cmdline) as cmdlines by host auid threat | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where Computer has_any ('quantum','frick')
| where SyslogMessage has 'type=EXECVE'
| where SyslogMessage matches regex 'a0=.?([^ ]*/)?(sh|bash|busybox).? a1=.?-c' or SyslogMessage matches regex 'a0=.?([^ ]*/)?(wget|curl|tftp|nc|ncat).?( |$)'
| project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage
| order by TimeGenerated desc

Sigma

title: Shell or Download Utility Execution on Frick Controls Quantum HD Controller
id: d4f6b8ca-3e5a-4b7d-9ea1-2f4a6b8cad04
status: experimental
description: Detects auditd EXECVE records where a shell is invoked with -c or a download/netcat utility is executed on a Quantum HD controller host, consistent with command execution after exploitation of CVE-2026-21658 or sibling CVE-2026-21654. Scope the rule to controller hosts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
  - https://nvd.nist.gov/vuln/detail/CVE-2026-21658
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1059
  - cve.2026.21658
logsource:
  product: linux
  service: auditd
detection:
  selection_shell:
    type: 'EXECVE'
    a0:
      - 'sh'
      - '/bin/sh'
      - 'bash'
      - '/bin/bash'
      - 'busybox'
      - '/bin/busybox'
    a1: '-c'
  selection_tools:
    type: 'EXECVE'
    a0:
      - 'wget'
      - '/usr/bin/wget'
      - 'curl'
      - '/usr/bin/curl'
      - 'tftp'
      - 'nc'
      - 'ncat'
      - '/bin/nc'
  condition: 1 of selection_*
falsepositives:
  - Authorised maintenance sessions by Johnson Controls support or site engineers
  - Vendor firmware update scripts that call wget/curl
level: high

Known false positives:

• Authorised maintenance or vendor support sessions on the controller
• Vendor update scripts that legitimately call wget or curl

Tuning notes: Requires auditd execve rules on the controller (or a syslog-forwarding collector with the same coverage). Replace host wildcards with the asset inventory. Suppress approved maintenance windows and known vendor update jobs by auid or parent process.

• 🔒 Internet-Sourced Connection Accepted to Frick Controls Quantum HD (Pre-Auth Exposure) · unlock with TL Creds
• 🔒 Credential and Configuration File Read via Command Line on Quantum HD Controller · unlock with TL Creds
• 🔒 Service Crash or Restart Storm on Quantum HD Controller (Denial of Service Indicator) · unlock with TL Creds
• 🔒 Path Traversal Request to Frick Controls Quantum HD Web Interface (Sibling CVE-2026-21659) · unlock with TL Creds
• 🔒 Payload Download and Staging in Temp Directories on Quantum HD Controller · unlock with TL Creds
• 🔒 Reverse Shell: Shell or Netcat Process Connecting to Public Address from Quantum HD Controller · unlock with TL Creds
• 🔒 Command/Code Injection Payload in HTTP Request to Frick Controls Quantum HD (CVE-2026-21658) · unlock with TL Creds
• 🔒 Frick Controls Quantum HD Controller Initiating Outbound Connections to Non-Private Addresses · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5920.

Sample indicators (2 of 8)

• URL: hxxps://fr[.]claroty[.]com/team82/disclosure-dashboard/cve-2026-21658
• URL: hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-057-01

Defanged, TLP:CLEAR. Full set of 8 indicators: unlock with TL Creds.

Technical analysis

CVE-2026-21658 affects the Johnson Controls Frick Controls Quantum HD, a controller used in industrial refrigeration and cold-storage environments (CISA lists the Food and Agriculture sector, deployed worldwide). The CVE/CISA description states that insufficient validation of input in certain parameters may allow unexpected actions that affect device security before authentication. CISA's advisory ICSA-26-057-01 (released 2026-02-26) tabulates the CVE as CWE-94 (Improper Control of Generation of Code / Code Injection) with CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), and summarizes the advisory-level impact as pre-authentication remote code execution, information leak, or denial of service.

The flaw was reported by Noam Moshe of the Claroty Research Team 82 (Team82) and published to NVD on 2026-02-27 by Johnson Controls as CNA. It is one of six CVEs covered by the same advisory and Johnson Controls Product Security Advisory JCI-PSA-2026-05: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21656 (CWE-94, 9.1), CVE-2026-21657 (CWE-94, 9.1), CVE-2026-21658 (CWE-94, 9.1), CVE-2026-21659 (CWE-23 relative path traversal, 7.5) and CVE-2026-21660 (hardcoded/plaintext credential storage, 6.2, local vector). Defenders should treat the family as a single exposure on the same devices.

Source discrepancies are noted for transparency. CISA's advisory lists the affected product as Quantum HD <=10.22, whereas the Claroty Team82 page and the CISA mitigation text describe versions 10.22 through 11 as legacy platforms past end of support. The Team82 page does not list a vector string, CWE or dates; the vector and CWE above come from the CISA advisory table. The exact exploitable parameters and request path are not publicly documented in the cited sources, and no public proof-of-concept is cited. As of the advisory, CISA reported no known public exploitation specifically targeting these vulnerabilities.

Remediation per the vendor: upgrade to Quantum HD Unity version 12 or higher using the vendor's update procedure, then verify compliance with the hardening guide and apply recommended security configurations. CISA general guidance applies: minimize network exposure, keep control systems off the internet, place them behind firewalls isolated from business networks, and use up-to-date VPNs for remote access.

MITRE ATT&CK techniques by tactic:

Execution

T0807 Command-Line Interface; T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell

inhibit-response-function

T0814 Denial of Service

Collection

T1005 Data from Local System

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Remediation

Patches

• Upgrade to Frick Controls Quantum HD Unity version 12 or higher using the Johnson Controls Quantum HD Unity software update procedure (see JCI-PSA-2026-05)

Immediate actions

• Ensure Frick Controls Quantum HD controllers are not reachable from the internet and restrict access to trusted management hosts only
• Place controllers behind firewalls and isolate them from business networks
• Use up-to-date VPNs for any required remote access
• Monitor network traffic to and from Quantum HD web/management interfaces for anomalous or malformed requests

Workarounds

• No vendor workaround is stated in the cited sources; rely on network isolation and segmentation until the upgrade is completed

Longer-term hardening

• Retire legacy Quantum HD 10.22 through 11 platforms (past end of support) in favor of Quantum HD Unity
• Verify compliance with the Johnson Controls hardening guide after upgrade and apply all recommended security configurations
• Perform impact analysis and risk assessment before deploying defensive measures on production control systems

Affected and fixed versions

• Johnson Controls — Frick Controls Quantum HD
  Vulnerable versions: <=10.22 (CISA advisory); 10.22 through 11 (legacy, past end of support per Team82/CISA mitigation text)
  Fixed in: Quantum HD Unity 12 or higher

Timeline

• 2026-02-26 Noam Moshe of Claroty Research Team 82 is credited with reporting all six vulnerabilities to CISA; the Team82 disclosure dashboard lists CVE-2026-21658 as Critical (CVSS v3 9.1) with no publication date.
• 2026-02-26 CISA publishes the machine-readable CSAF document for ICSA-26-057-01 (linked from the advisory on GitHub) alongside the initial advisory; Johnson Controls' Quantum HD Unity software update procedure PDF is linked as the vendor fix.
• 2026-02-26 CISA reports no known public exploitation specifically targeting these vulnerabilities at the time of the advisory.
• 2026-02-26 Johnson Controls guidance (JCI-PSA-2026-05) states Quantum HD 10.22 through 11 are legacy platforms past end of support and recommends upgrading to Quantum HD Unity v12 or higher, then applying the hardening guide.
• 2026-02-26 CISA releases ICS Advisory ICSA-26-057-01 (revision 1) for Johnson Controls Frick Controls Quantum HD, covering CVE-2026-21654, -21656, -21657, -21658, -21659 and -21660; credits Noam Moshe of Claroty Team 82.
• 2026-02-27 Sibling CVEs from the same advisory (e.g. CVE-2026-21654, CWE-78 OS command injection; CVE-2026-21656, CWE-94) published to NVD/CVE Program, referencing JCI-PSA-2026-05 for mitigation.
• 2026-02-27 CVE-2026-21658 published to NVD by Johnson Controls (CNA): insufficient input validation in certain parameters affecting device security before authentication; applies to version 10.22 and prior.
• 2026-11-13 Re-check of the CISA advisory during this research pass: still Revision 1 (2026-02-26), no later revisions, and no known public exploitation reported for these vulnerabilities.

Sources cited

• CISA ICS Advisory ICSA-26-057-01: Johnson Controls Frick Controls Quantum HD CISA · Government advisory · 2026-02-26
• NVD: CVE-2026-21658 NVD (NIST) · Advisory · 2026-02-27
• NVD: CVE-2026-21654 (sibling CVE, same advisory) NVD (NIST) · Advisory · 2026-02-27
• CVE Program record: CVE-2026-21656 (sibling CVE, credits Noam Moshe / Claroty Team 82) MITRE · Advisory
• CVE Program record: CVE-2026-21654 (references JCI-PSA-2026-05) MITRE · Advisory
• Claroty Team82 Disclosure Dashboard: CVE-2026-21658 fr.claroty.com · Research
• VulDB: CVE-2026-21658 in Frick Controls Quantum HD vuldb.com · Research
• Johnson Controls FRICK Quantum HD Unity System Controller (product page) johnsoncontrols.com · Vendor report

More in ics scada

• CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (<=1.12.1) Enabling Authenticated RCE via Crafted LCD State
• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Code Injection via Insufficient Input Validation (Pre-Authentication)
• CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Insufficient Input Validation (Pre-Authentication Code Injection)
• CVE-2026-21659 — Johnson Controls Frick Controls Quantum HD unauthenticated path traversal / local file inclusion leading to arbitrary code execution
• CVE-2025-13901 - Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)

Related coverage of this activity

• Frick Quantum HD code injection
• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD
• CVE-2026-21658 — Johnson Controls Frick Controls Quantum HD
• Frick Quantum HD CVE-2026-21656

Other reports on CVE-2026-21658

• CVE-2026-21654 - Johnson Controls Frick Controls Quantum HD Pre-Authentication OS Command Injection (ICSA-26-057-01)