# CVE-2026-21658: Pre-Authentication Input Validation / Code Injection Flaw in Johnson Controls Frick Controls Quantum HD (10.22 and earlier, legacy through 11)

> Claroty Team82 reported an insufficient-input-validation flaw (CWE-94 code injection per the CISA advisory table) in certain parameters of the Johnson Controls Frick Controls Quantum HD industrial refrigeration controller that can affect device security before authentication (CVSS v3.1 9.1). Legacy versions are past end of support; the vendor fix is migration to Quantum HD Unity v12 or later.

- **Published:** 2026-11-13T03:27:12Z
- **Last reviewed:** 2026-11-13T03:27:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5920
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5920.png
- **ID:** TL-2026-5920
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8 (2 shown free below)
- **CVEs:** CVE-2026-21658, CVE-2026-21654, CVE-2026-21656

## Description

CVE-2026-21658 affects the Johnson Controls Frick Controls Quantum HD, a controller used in industrial refrigeration and cold-storage environments (CISA lists the Food and Agriculture sector, deployed worldwide). The CVE/CISA description states that insufficient validation of input in certain parameters may allow unexpected actions that affect device security before authentication. CISA's advisory ICSA-26-057-01 (released 2026-02-26) tabulates the CVE as CWE-94 (Improper Control of Generation of Code / Code Injection) with CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), and summarizes the advisory-level impact as pre-authentication remote code execution, information leak, or denial of service.

The flaw was reported by Noam Moshe of the Claroty Research Team 82 (Team82) and published to NVD on 2026-02-27 by Johnson Controls as CNA. It is one of six CVEs covered by the same advisory and Johnson Controls Product Security Advisory JCI-PSA-2026-05: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21656 (CWE-94, 9.1), CVE-2026-21657 (CWE-94, 9.1), CVE-2026-21658 (CWE-94, 9.1), CVE-2026-21659 (CWE-23 relative path traversal, 7.5) and CVE-2026-21660 (hardcoded/plaintext credential storage, 6.2, local vector). Defenders should treat the family as a single exposure on the same devices.

Source discrepancies are noted for transparency. CISA's advisory lists the affected product as Quantum HD <=10.22, whereas the Claroty Team82 page and the CISA mitigation text describe versions 10.22 through 11 as legacy platforms past end of support. The Team82 page does not list a vector string, CWE or dates; the vector and CWE above come from the CISA advisory table. The exact exploitable parameters and request path are not publicly documented in the cited sources, and no public proof-of-concept is cited. As of the advisory, CISA reported no known public exploitation specifically targeting these vulnerabilities.

Remediation per the vendor: upgrade to Quantum HD Unity version 12 or higher using the vendor's update procedure, then verify compliance with the hardening guide and apply recommended security configurations. CISA general guidance applies: minimize network exposure, keep control systems off the internet, place them behind firewalls isolated from business networks, and use up-to-date VPNs for remote access.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1005 Data from Local System
- T1552.001 Unsecured Credentials: Credentials In Files
- T0814 Denial of Service
- T0807 Command-Line Interface

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Shell or Download Utility Executed on Frick Controls Quantum HD Controller (Post-Exploitation)** (`TL-2026-5920-SPL-002`)

Detects auditd EXECVE records on Quantum HD controller hosts where a shell is launched with -c (typical of a code/command injection reaching system()) or where wget/curl/tftp/netcat are executed. On a hardened refrigeration controller these executions are rare, and following CVE-2026-21658 / CVE-2026-21654 exploitation they indicate attacker command execution.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059, T1059.004, T0807
- **Data sources:** linux_auditd, linux:audit
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=linux sourcetype="linux:audit" type=EXECVE earliest=-24h (host="*quantum*" OR host="*frick*") ((a0 IN ("sh","/bin/sh","bash","/bin/bash","busybox","/bin/busybox") a1="-c") OR a0 IN ("wget","/usr/bin/wget","curl","/usr/bin/curl","tftp","nc","ncat","/bin/nc")) | eval cmdline=trim(a0." ".coalesce(a1,"")." ".coalesce(a2,"")." ".coalesce(a3,"")) | eval threat="TL-2026-5920 CVE-2026-21658 post-exploitation shell execution" | stats count min(_time) as first_seen max(_time) as last_seen values(cmdline) as cmdlines by host auid threat | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where Computer has_any ('quantum','frick')
| where SyslogMessage has 'type=EXECVE'
| where SyslogMessage matches regex 'a0=.?([^ ]*/)?(sh|bash|busybox).? a1=.?-c' or SyslogMessage matches regex 'a0=.?([^ ]*/)?(wget|curl|tftp|nc|ncat).?( |$)'
| project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage
| order by TimeGenerated desc
```

### Sigma

```yaml
title: Shell or Download Utility Execution on Frick Controls Quantum HD Controller
id: d4f6b8ca-3e5a-4b7d-9ea1-2f4a6b8cad04
status: experimental
description: Detects auditd EXECVE records where a shell is invoked with -c or a download/netcat utility is executed on a Quantum HD controller host, consistent with command execution after exploitation of CVE-2026-21658 or sibling CVE-2026-21654. Scope the rule to controller hosts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
  - https://nvd.nist.gov/vuln/detail/CVE-2026-21658
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1059
  - cve.2026.21658
logsource:
  product: linux
  service: auditd
detection:
  selection_shell:
    type: 'EXECVE'
    a0:
      - 'sh'
      - '/bin/sh'
      - 'bash'
      - '/bin/bash'
      - 'busybox'
      - '/bin/busybox'
    a1: '-c'
  selection_tools:
    type: 'EXECVE'
    a0:
      - 'wget'
      - '/usr/bin/wget'
      - 'curl'
      - '/usr/bin/curl'
      - 'tftp'
      - 'nc'
      - 'ncat'
      - '/bin/nc'
  condition: 1 of selection_*
falsepositives:
  - Authorised maintenance sessions by Johnson Controls support or site engineers
  - Vendor firmware update scripts that call wget/curl
level: high

```

**Known false positives:**

- Authorised maintenance or vendor support sessions on the controller
- Vendor update scripts that legitimately call wget or curl

**Tuning notes:** Requires auditd execve rules on the controller (or a syslog-forwarding collector with the same coverage). Replace host wildcards with the asset inventory. Suppress approved maintenance windows and known vendor update jobs by auid or parent process.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Internet-Sourced Connection Accepted to Frick Controls Quantum HD (Pre-Auth Exposure) (locked: unlock with TL Creds)
- Credential and Configuration File Read via Command Line on Quantum HD Controller (locked: unlock with TL Creds)
- Service Crash or Restart Storm on Quantum HD Controller (Denial of Service Indicator) (locked: unlock with TL Creds)
- Path Traversal Request to Frick Controls Quantum HD Web Interface (Sibling CVE-2026-21659) (locked: unlock with TL Creds)
- Payload Download and Staging in Temp Directories on Quantum HD Controller (locked: unlock with TL Creds)
- Reverse Shell: Shell or Netcat Process Connecting to Public Address from Quantum HD Controller (locked: unlock with TL Creds)
- Command/Code Injection Payload in HTTP Request to Frick Controls Quantum HD (CVE-2026-21658) (locked: unlock with TL Creds)
- Frick Controls Quantum HD Controller Initiating Outbound Connections to Non-Private Addresses (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 8)

Defanged, TLP:CLEAR.

- URL: `hxxps://fr[.]claroty[.]com/team82/disclosure-dashboard/cve-2026-21658`
- URL: `hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-057-01`

Full set of 8 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Claroty Team82 Disclosure Dashboard: CVE-2026-21658](https://fr.claroty.com/team82/disclosure-dashboard/cve-2026-21658)
- [CISA ICS Advisory ICSA-26-057-01: Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD: CVE-2026-21658](https://nvd.nist.gov/vuln/detail/CVE-2026-21658)
- [NVD: CVE-2026-21654 (sibling CVE, same advisory)](https://nvd.nist.gov/vuln/detail/CVE-2026-21654)
- [CVE Program record: CVE-2026-21656 (sibling CVE, credits Noam Moshe / Claroty Team 82)](https://cveawg.mitre.org/api/cve/CVE-2026-21656)
- [CVE Program record: CVE-2026-21654 (references JCI-PSA-2026-05)](https://cveawg.mitre.org/api/cve/CVE-2026-21654)
- [VulDB: CVE-2026-21658 in Frick Controls Quantum HD](https://vuldb.com/cve/CVE-2026-21658)
- [Johnson Controls FRICK Quantum HD Unity System Controller (product page)](https://www.johnsoncontrols.com/industrial-refrigeration/industrial-refrigeration/quantum-hd-unity-system-controller)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5920