CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Insufficient Input Validation (Pre-Authentication Code Injection)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5921 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-21657 Quantum HD Pre-Auth Code Injection — Exploitation Attempt (Splunk)

Detects HTTP requests to Frick Controls Quantum HD controllers (firmware 10.22 through 11, ICSA-26-057-01) whose URI contains code or command injection patterns, the CWE-94 pre-authentication trigger class (T1190, T1059). The vulnerable parameter is not public, so this is behaviour-first and scoped to known controller IPs via the quantum_hd_controllers.csv lookup (field dest_ip).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T0819
• Data sources: zeek_http (index=network sourcetype=bro:http:json), quantum_hd_controllers.csv lookup
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype="bro:http:json" earliest=-24h
    [| inputlookup quantum_hd_controllers.csv | rename dest_ip AS "id.resp_h" | fields "id.resp_h"]
| eval uri_dec=urldecode(coalesce(uri,""))
| where match(uri_dec, "(?i)([;|&]\s*(sh|bash|cat|wget|curl|nc|chmod|tftp)(\s|$)|[$]\x28|(eval|exec|system)\x28|os[.]execute|<[?]php)")
| stats count min(_time) AS first_seen max(_time) AS last_seen values(uri_dec) AS uris values(method) AS methods values(status_code) AS status_codes BY id.orig_h id.resp_h
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let controllers = toscalar(_GetWatchlist('QuantumHDControllers') | summarize make_set(tostring(SearchKey)));
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (controllers)
| extend DecodedUrl = url_decode(RequestURL)
| where DecodedUrl matches regex @"(?i)([;|&]\s*(sh|bash|cat|wget|curl|nc|chmod|tftp)(\s|$)|[$]\x28|(eval|exec|system)\x28|os[.]execute|<[?]php)"
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL, DeviceVendor, DeviceProduct, DeviceAction

Sigma

title: CVE-2026-21657 Frick Controls Quantum HD Pre-Auth Code Injection Attempt
id: 6f1d2a3c-5b7e-4c1a-9d3e-2a8b7c4e5f01
status: experimental
description: Detects HTTP requests to Johnson Controls Frick Controls Quantum HD controllers (firmware 10.22 through 11) carrying code or command injection metacharacters in the URI, consistent with CWE-94 pre-authentication code injection (ICSA-26-057-01). The exact vulnerable parameter is not public, so the rule is behaviour-based.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21657
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - cve.2026.21657
logsource:
    product: zeek
    service: http
detection:
    selection_target:
        id.resp_h|cidr:
            - '10.20.30.0/24'
    selection_inject:
        uri|contains:
            - '$('
            - '%24%28'
            - ';wget'
            - ';curl'
            - ';sh'
            - '|sh'
            - '|bash'
            - 'eval('
            - 'exec('
            - 'system('
            - 'os.execute'
            - '<?php'
    condition: selection_target and selection_inject
falsepositives:
    - Vulnerability scanners run by the OT security team against controllers
    - Engineering tools that legitimately send semicolon-delimited parameters
level: high

Known false positives:

• Authorized vulnerability scans of the controllers
• Engineering tools sending semicolon-delimited parameters

Tuning notes: Populate quantum_hd_controllers.csv (field dest_ip) with real controller IPs. Exclude approved scanner source IPs. Extend the regex once the vulnerable parameter is publicly documented.

• 🔒 CVE-2026-21657 Quantum HD Pre-Auth Code Injection — Exploitation Attempt (Sentinel) · unlock with TL Creds
• 🔒 CVE-2026-21657 Quantum HD — Unauthorized Parameter/Setpoint Writes After Compromise (Sentinel) · unlock with TL Creds
• 🔒 CVE-2026-21657 Quantum HD — Controller-Initiated Egress and Lateral Fan-Out (Sentinel) · unlock with TL Creds
• 🔒 CVE-2026-21657 Quantum HD Pre-Auth Code Injection — Exploitation Attempt (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-21657 Quantum HD — Unauthorized Parameter/Setpoint Writes After Compromise (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-21657 Quantum HD — Controller-Initiated Egress and Lateral Fan-Out (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-21657 Quantum HD — Unauthorized Parameter/Setpoint Writes After Compromise (Splunk) · unlock with TL Creds
• 🔒 CVE-2026-21657 Quantum HD — Controller-Initiated Egress and Lateral Fan-Out (Splunk) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5921.

Technical analysis

CVE-2026-21657 affects the Frick Controls Quantum HD, an industrial refrigeration controller used to manage compressors, setpoints, safety limits and operating parameters in cold storage, food processing and pharmaceutical manufacturing environments. Per CISA and Claroty Team82, insufficient validation of input in certain parameters may permit unexpected actions and affect device security before authentication. The weakness is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The CISA/Johnson Controls CNA score is CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); NVD's own primary score is 9.8 (C:H/I:H/A:H), and Johnson Controls (productsecurity@jci.com) supplies a CVSS v4.0 score of 8.8 (HIGH).

The vulnerability was reported to CISA by Noam Moshe of Claroty Research Team82 and published in CISA advisory ICSA-26-057-01 on 2026-02-26 (NVD publication 2026-02-27). The same advisory covers five sibling vulnerabilities in the same product: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21656 and CVE-2026-21658 (CWE-94 code injection, 9.1), CVE-2026-21659 (CWE-23 relative path traversal, 7.5) and CVE-2026-21660 (hardcoded credentials, 6.2). Third-party analysis (Burns & McDonnell / 1898 & Co.) describes CVE-2026-21657 as a pre-authentication code injection in a different network-facing parameter than its siblings. Exploitation requires only network reachability of the device's web interface, with no credentials or user interaction.

Burns & McDonnell's analysis states the controllers are often reachable from engineering workstations and business networks and sometimes from the internet through misconfiguration, and describes post-exploitation impacts including filesystem access, persistence, manipulation of refrigeration parameters and pivoting into OT/IT networks. These impact descriptions come from that analysis; no public proof-of-concept or technical exploit details are published in the primary sources.

Exploitation status: CISA reports no known public exploitation specifically targeting these vulnerabilities at publication, and no public PoC was identified in the sources reviewed. Versions 10.22 through 11 are legacy end-of-support platforms; the vendor remediation is migration to Quantum HD Unity version 12 or higher, followed by verification against the hardening guide (Johnson Controls Product Security Advisory JCI-PSA-2026-05). No network, file or hash IOCs have been published for this vulnerability; the IOC list below consists of exposure markers, product identifiers and behavioral detection indicators drawn from the advisories. No BeaconBeagle lookup was applicable because no IP addresses or domains are associated with the threat.

MITRE ATT&CK techniques by tactic:

Initial Access

T0819 Exploit Public-Facing Application; T1190 Exploit Public-Facing Application

Execution

T1059 Command and Scripting Interpreter

Remediation

Patches

• Upgrade to Frick Controls Quantum HD Unity version 12 or higher per the vendor software update procedure
• Apply Johnson Controls Product Security Advisory JCI-PSA-2026-05

Immediate actions

• Isolate Quantum HD controllers from the internet and business networks; block direct external access to the device web interface until patched
• Identify internet-reachable or out-of-perimeter Quantum HD devices and isolate them first
• Log and review access attempts to controller interfaces during the unpatched period

Workarounds

• After upgrading to v12, verify full compliance with the hardening guide and apply all recommended security configurations
• Minimize network exposure of control system devices per CISA recommended practices

Longer-term hardening

• Place controllers on dedicated OT segments behind industrial firewalls
• Require VPN with strong MFA for any remote access
• Monitor for anomalous HTTP traffic, unexpected command execution and new outbound connections from controller IPs
• Plan migration off end-of-support Quantum HD 10.22 through 11 platforms

Affected and fixed versions

• Johnson Controls — Frick Controls Quantum HD
  Vulnerable versions: 10.22 through 11 (<= 10.22 per NVD CPE; end-of-support legacy platforms)
  Fixed in: Quantum HD Unity version 12 or higher

Timeline

• 2026-02-26 Johnson Controls Product Security Advisory JCI-PSA-2026-05 directs customers on legacy 10.22 through 11 platforms to upgrade to Quantum HD Unity v12 or higher and apply the hardening guide.
• 2026-02-26 CISA publishes ICS advisory ICSA-26-057-01 for Johnson Controls Frick Controls Quantum HD covering CVE-2026-21654, -21656, -21657, -21658, -21659 and -21660; vulnerabilities credited to Noam Moshe of Claroty Team82.
• 2026-02-27 CVE-2026-21657 published in NVD as CWE-94 code injection; Johnson Controls CNA supplies a CVSS v4.0 score of 8.8 (HIGH).
• 2026-03-06 Burns & McDonnell 1898 & Co. publishes an analysis of the Quantum HD pre-authentication vulnerabilities with mitigation guidance for refrigeration environments.
• 2026-04-29 Burns & McDonnell advisory page metadata last modified.
• 2026-06-17 NVD record last modified with status Analyzed; primary CVSS v3.1 score of 9.8 (C:H/I:H/A:H) and CPE configuration for firmware up to and including 10.22.

Sources cited

• CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD CISA · Government advisory · 2026-02-26
• NVD - CVE-2026-21657 NVD (NIST) · Advisory · 2026-02-27
• CVE Record - CVE-2026-21657 MITRE · Advisory · 2026-02-27
• Claroty Team82 Disclosure Dashboard - CVE-2026-21657 fr.claroty.com · Research
• Johnson Controls Product Security Advisories (JCI-PSA-2026-05) johnsoncontrols.com · Vendor report · 2026-02-26
• Frick Quantum HD Unity Software Update Procedure (vendor PDF) frickcontrolsblob.file.core.windows.net · Vendor report
• Positive Technologies dbugs - PT-2026-22323 Johnson Controls Quantum HD dbugs.ptsecurity.com · Research
• Burns & McDonnell 1898 & Co. - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD 1898advisories.burnsmcd.com · Blog · 2026-03-06

More in ics scada

• CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (<=1.12.1) Enabling Authenticated RCE via Crafted LCD State
• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Code Injection via Insufficient Input Validation (Pre-Authentication)
• CVE-2026-21658: Pre-Authentication Input Validation / Code Injection Flaw in Johnson Controls Frick Controls Quantum HD (10.22 and earlier, legacy through 11)
• CVE-2026-21659 — Johnson Controls Frick Controls Quantum HD unauthenticated path traversal / local file inclusion leading to arbitrary code execution
• CVE-2025-13901 - Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)

Related coverage of this activity

• Frick Quantum HD refrigeration RCE
• Frick Quantum HD pre-auth flaw
• Frick Quantum HD command injection