# CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Insufficient Input Validation (Pre-Authentication Code Injection) > CVE-2026-21657 is a pre-authentication code injection flaw (CWE-94) in the web-facing interface of the Johnson Controls Frick Controls Quantum HD industrial refrigeration controller (firmware 10.22 through 11, end-of-support). Disclosed by Claroty Team82 and published by CISA as ICSA-26-057-01 with CVSS 9.1; the fix is to upgrade to Quantum HD Unity v12 or later. - **Published:** 2026-11-13T03:47:25Z - **Last reviewed:** 2026-11-13T03:47:25Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5921 - **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5921.png - **ID:** TL-2026-5921 - **Severity:** CRITICAL (CVSS 9.1) - **Category:** ICS_SCADA - **Status:** PATCHED - **Detections:** 9 (1 shown free below) · **IOCs:** 8 - **CVEs:** CVE-2026-21657 ## Description CVE-2026-21657 affects the Frick Controls Quantum HD, an industrial refrigeration controller used to manage compressors, setpoints, safety limits and operating parameters in cold storage, food processing and pharmaceutical manufacturing environments. Per CISA and Claroty Team82, insufficient validation of input in certain parameters may permit unexpected actions and affect device security before authentication. The weakness is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The CISA/Johnson Controls CNA score is CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); NVD's own primary score is 9.8 (C:H/I:H/A:H), and Johnson Controls (productsecurity@jci.com) supplies a CVSS v4.0 score of 8.8 (HIGH). The vulnerability was reported to CISA by Noam Moshe of Claroty Research Team82 and published in CISA advisory ICSA-26-057-01 on 2026-02-26 (NVD publication 2026-02-27). The same advisory covers five sibling vulnerabilities in the same product: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21656 and CVE-2026-21658 (CWE-94 code injection, 9.1), CVE-2026-21659 (CWE-23 relative path traversal, 7.5) and CVE-2026-21660 (hardcoded credentials, 6.2). Third-party analysis (Burns & McDonnell / 1898 & Co.) describes CVE-2026-21657 as a pre-authentication code injection in a different network-facing parameter than its siblings. Exploitation requires only network reachability of the device's web interface, with no credentials or user interaction. Burns & McDonnell's analysis states the controllers are often reachable from engineering workstations and business networks and sometimes from the internet through misconfiguration, and describes post-exploitation impacts including filesystem access, persistence, manipulation of refrigeration parameters and pivoting into OT/IT networks. These impact descriptions come from that analysis; no public proof-of-concept or technical exploit details are published in the primary sources. Exploitation status: CISA reports no known public exploitation specifically targeting these vulnerabilities at publication, and no public PoC was identified in the sources reviewed. Versions 10.22 through 11 are legacy end-of-support platforms; the vendor remediation is migration to Quantum HD Unity version 12 or higher, followed by verification against the hardening guide (Johnson Controls Product Security Advisory JCI-PSA-2026-05). No network, file or hash IOCs have been published for this vulnerability; the IOC list below consists of exposure markers, product identifiers and behavioral detection indicators drawn from the advisories. No BeaconBeagle lookup was applicable because no IP addresses or domains are associated with the threat. ## MITRE ATT&CK - T1190 Exploit Public-Facing Application - T1059 Command and Scripting Interpreter - T0819 Exploit Public-Facing Application ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **CVE-2026-21657 Quantum HD Pre-Auth Code Injection — Exploitation Attempt (Splunk)** (`TL-2026-5921-SPL-001`) Detects HTTP requests to Frick Controls Quantum HD controllers (firmware 10.22 through 11, ICSA-26-057-01) whose URI contains code or command injection patterns, the CWE-94 pre-authentication trigger class (T1190, T1059). The vulnerable parameter is not public, so this is behaviour-first and scoped to known controller IPs via the quantum_hd_controllers.csv lookup (field dest_ip). - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1190, T1059, T0819 - **Data sources:** zeek_http (index=network sourcetype=bro:http:json), quantum_hd_controllers.csv lookup - **Severity:** critical - **Confidence:** high ### Splunk SPL ```spl index=network sourcetype="bro:http:json" earliest=-24h [| inputlookup quantum_hd_controllers.csv | rename dest_ip AS "id.resp_h" | fields "id.resp_h"] | eval uri_dec=urldecode(coalesce(uri,"")) | where match(uri_dec, "(?i)([;|&]\s*(sh|bash|cat|wget|curl|nc|chmod|tftp)(\s|$)|[$]\x28|(eval|exec|system)\x28|os[.]execute|<[?]php)") | stats count min(_time) AS first_seen max(_time) AS last_seen values(uri_dec) AS uris values(method) AS methods values(status_code) AS status_codes BY id.orig_h id.resp_h | convert ctime(first_seen) ctime(last_seen) ``` ### Microsoft KQL ```kql let controllers = toscalar(_GetWatchlist('QuantumHDControllers') | summarize make_set(tostring(SearchKey))); CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationIP in (controllers) | extend DecodedUrl = url_decode(RequestURL) | where DecodedUrl matches regex @"(?i)([;|&]\s*(sh|bash|cat|wget|curl|nc|chmod|tftp)(\s|$)|[$]\x28|(eval|exec|system)\x28|os[.]execute|<[?]php)" | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL, DeviceVendor, DeviceProduct, DeviceAction ``` ### Sigma ```yaml title: CVE-2026-21657 Frick Controls Quantum HD Pre-Auth Code Injection Attempt id: 6f1d2a3c-5b7e-4c1a-9d3e-2a8b7c4e5f01 status: experimental description: Detects HTTP requests to Johnson Controls Frick Controls Quantum HD controllers (firmware 10.22 through 11) carrying code or command injection metacharacters in the URI, consistent with CWE-94 pre-authentication code injection (ICSA-26-057-01). The exact vulnerable parameter is not public, so the rule is behaviour-based. references: - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01 - https://nvd.nist.gov/vuln/detail/CVE-2026-21657 author: Threadlinqs Team date: 2026-11-13 tags: - attack.initial-access - attack.t1190 - attack.execution - attack.t1059 - cve.2026.21657 logsource: product: zeek service: http detection: selection_target: id.resp_h|cidr: - '10.20.30.0/24' selection_inject: uri|contains: - '$(' - '%24%28' - ';wget' - ';curl' - ';sh' - '|sh' - '|bash' - 'eval(' - 'exec(' - 'system(' - 'os.execute' - '