# CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Code Injection via Insufficient Input Validation (Pre-Authentication)

> CVE-2026-21656 is a critical code-injection flaw (CWE-94) in Johnson Controls Frick Controls Quantum HD firmware 10.22 and earlier, caused by insufficient validation of input in certain parameters and reachable before authentication. Disclosed by Claroty Team82 and published by CISA as ICSA-26-057-01; no public exploitation has been reported.

- **Published:** 2026-11-13T04:31:48Z
- **Last reviewed:** 2026-11-13T04:31:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5924
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5924.png
- **ID:** TL-2026-5924
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (2 shown free below)
- **CVEs:** CVE-2026-21656

## Description

CVE-2026-21656 affects the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration control platform used worldwide, notably in the Food and Agriculture sector. The vendor states that insufficient validation of input in certain parameters may permit unexpected actions that could affect device security before authentication occurs. NVD classifies the weakness as CWE-94 (Improper Control of Generation of Code, 'Code Injection') and scores it CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor CNA (productsecurity@jci.com) also supplies a CVSS v4.0 score of 8.8 (High). The CISA advisory ICSA-26-057-01 lists the CVE at CVSS v3.1 9.1 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), and the Claroty Team82 disclosure page and the Burns & McDonnell 1898 & Co. write-up also show 9.1. Aviatrix lists 8.8. The sources therefore disagree on the base score; this record uses the NVD primary score.

CISA's ICSA-26-057-01 (released 2026-02-26) states that successful exploitation of the vulnerabilities in the advisory can lead to pre-authentication remote code execution, information leak, or denial of service. The same advisory covers five sibling CVEs: CVE-2026-21654 (CWE-78 OS command injection), CVE-2026-21657 and CVE-2026-21658 (CWE-94), CVE-2026-21659 (CWE-23 relative path traversal) and CVE-2026-21660 (CWE-256 plaintext password storage). CISA notes that the descriptions and CWEs/vectors for CVE-2026-21659 and CVE-2026-21660 do not align cleanly. Burns & McDonnell (1898 & Co.) explains that the four injection flaws (CVE-2026-21654, -21656, -21657, -21658) share a root cause, insufficient input validation on the network-facing interface before authentication, but reach it through different parameters, so no single input-validation fix covers them all and only the firmware upgrade closes every vector. It describes post-exploitation possibilities as filesystem reads and writes, changes to refrigeration control parameters, persistent backdoors, and pivoting into OT or IT networks, and notes that the hardcoded-credential issue (CVE-2026-21660) cannot be addressed by password rotation. These are analyst assessments, not observed attacker behavior. A third-party brief (CraftedSignal) describes the generic attack pattern as a specially crafted request to a network-exposed device that injects code the device then executes, with possible follow-on actions of accessing sensitive information, crashing the device, and moving laterally within the OT network. Aviatrix publishes a modeled attack chain (code injection for initial access, hardcoded credentials for privilege escalation, then lateral movement, C2, exfiltration and disruption) and maps T1190, T1059, T1078, T1003 and T1499; the page itself states it is a modeled scenario, names no actor or victim, and lists no public exploit.

Exploitation status: CISA states that no known public exploitation specifically targeting these vulnerabilities had been reported to CISA at the time of the advisory. The CISA SSVC assessment recorded in NVD is Exploitation: none, Automatable: yes, Technical Impact: total. No public proof-of-concept, exploit code, malware, threat actor, or network IOC (IP/domain/hash) was identified in any source reviewed, and BeaconBeagle correlation was not applicable because there are no network IOCs.

Affected and remediation: NVD lists the Frick Controls Quantum HD firmware, all versions up to and including 10.22, as vulnerable (the hardware CPE is marked not vulnerable). CISA and Claroty state that versions 10.22 through 11 are legacy platforms that have reached end of support. Johnson Controls recommends upgrading to Quantum HD Unity version 12 or higher, then verifying full compliance with the hardening guide and applying all recommended security configurations (Johnson Controls Product Security Advisory JCI-PSA-2026-05). CISA's general ICS guidance applies: minimize network exposure, isolate control systems behind firewalls, and use VPNs for remote access. 1898 & Co. additionally recommends OT network monitoring for anomalous HTTP traffic, unexpected command execution and new outbound connections from controller IPs, plus egress restriction. The vulnerability was reported to CISA by Noam Moshe of Claroty Research Team82.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T0866 Exploitation of Remote Services
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1552.001 Credentials In Files
- T1078 Valid Accounts
- T1005 Data from Local System
- T1021 Remote Services

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Quantum HD Config/Credential File Retrieval - Post-Exploitation** (`TL-2026-5924-SPL-002`)

SPL search for HTTP 200 responses serving configuration, backup, password or credential files from a Quantum HD controller to hosts outside the known engineering set. Covers analyst-assessed post-exploitation of CVE-2026-21656 (filesystem reads, credential harvesting and reuse of recovered accounts). These behaviours are assessed, not observed in the wild.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1005, T1083, T1552.001, T1078
- **Data sources:** zeek_http, ics_network_monitoring
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=zeek sourcetype="bro:http:json" earliest=-24h [| inputlookup quantum_hd_controllers.csv | rename ip AS "id.resp_h" | fields "id.resp_h"] NOT [| inputlookup quantum_hd_admin_hosts.csv | rename ip AS "id.orig_h" | fields "id.orig_h"]
```comment: post-exploitation file and credential harvesting from a Quantum HD controller - config, backup or password files served with HTTP 200 to a non-admin host```
| eval uri_dec=urldecode(uri)
| where status_code=200 AND match(uri_dec, "(?i)(/etc/(passwd|shadow)|\.(cfg|conf|ini|db|bak)\b|backup|passwd|password|credential)")
| stats count AS hits sum(response_body_len) AS bytes_returned dc(uri_dec) AS distinct_files values(uri_dec) AS files values(username) AS usernames BY "id.orig_h" "id.resp_h"
| sort - bytes_returned
````

### Microsoft KQL

```kql
let Controllers = _GetWatchlist('QuantumHD_Controllers') | project ControllerIP = tostring(SearchKey);
let KnownAdmins = _GetWatchlist('QuantumHD_AdminHosts') | project AdminIP = tostring(SearchKey);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (Controllers)
| where SourceIP !in (KnownAdmins)
| extend UriDecoded = url_decode(RequestURL)
| where UriDecoded matches regex @'(?i)(/etc/(passwd|shadow)|\.(cfg|conf|ini|db|bak)\b|backup|passwd|password|credential)'
| summarize Hits = count(), DistinctFiles = dcount(UriDecoded), Files = make_set(UriDecoded, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, SourceUserName
| project FirstSeen, LastSeen, SourceIP, DestinationIP, SourceUserName, Hits, DistinctFiles, Files
```

### Sigma

```yaml
title: Quantum HD Configuration or Credential File Retrieval via Web Interface
id: 2f8b6d90-4c1a-4e73-9b25-a7d03c5e8b02
status: experimental
description: Detects successful HTTP 200 retrieval of configuration, backup or credential files from a Quantum HD controller web interface, consistent with post-exploitation file read and credential harvesting after CVE-2026-21656 exploitation.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21656
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.collection
    - attack.t1005
    - attack.discovery
    - attack.t1083
    - attack.credential-access
    - attack.t1552.001
    - cve.2026.21656
logsource:
    product: zeek
    service: http
detection:
    selection:
        status_code: 200
        uri|contains:
            - '/etc/passwd'
            - '/etc/shadow'
            - '.cfg'
            - '.conf'
            - '.ini'
            - '.bak'
            - 'backup'
            - 'password'
            - 'credential'
    condition: selection
falsepositives:
    - Engineering staff exporting controller configuration or backups from an approved workstation
    - Scheduled configuration backup jobs
level: high

```

**Known false positives:**

- Approved configuration export or backup from engineering workstations not yet in the admin lookup
- Vendor support sessions

**Tuning notes:** Populate quantum_hd_controllers.csv and quantum_hd_admin_hosts.csv (column ip). Raise the hits threshold or add a bytes_returned floor if backup jobs are noisy. Review the usernames field for unexpected or vendor-default accounts (T1078 reuse of recovered credentials).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Quantum HD Injection, Scanning and Flood Activity - Exploitation (locked: unlock with TL Creds)
- Quantum HD Config/Credential File Access from Unknown Host - Post-Exploitation (locked: unlock with TL Creds)
- Quantum HD Controller Outbound Pivot - C2 and Lateral Movement (locked: unlock with TL Creds)
- Sigma: Quantum HD Pre-Auth Code Injection Attempt (CVE-2026-21656) (locked: unlock with TL Creds)
- Sigma: Quantum HD Config/Credential File Retrieval (locked: unlock with TL Creds)
- Sigma: Possible Quantum HD Controller Pivot via Remote Services (locked: unlock with TL Creds)
- Quantum HD Pre-Auth Code Injection Attempt (CVE-2026-21656) - Exploitation (locked: unlock with TL Creds)
- Quantum HD Controller Outbound Pivot / New Egress - C2 and Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 9)

Defanged, TLP:CLEAR.

- URL: `hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-057-01`
- URL: `hxxps://1898advisories[.]burnsmcd[.]com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-21656](https://claroty.com/team82/disclosure-dashboard/cve-2026-21656)
- [NVD - CVE-2026-21656](https://nvd.nist.gov/vuln/detail/CVE-2026-21656)
- [Johnson Controls Product Security Advisories (JCI-PSA-2026-05)](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [CraftedSignal - Frick Controls Quantum HD Vulnerabilities brief](https://feed.craftedsignal.io/briefs/2026-02-quantum-hd-vulns/)
- [1898 & Co. (Burns & McDonnell) - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD Industrial Refrigeration Controller](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution](https://aviatrix.ai/threat-research-center/johnson-controls-2026-unauthenticated-remote-code-execution/)
- [SentinelOne Vulnerability Database - CVE-2026-21656](https://www.sentinelone.com/vulnerability-database/cve-2026-21656/)
- [INCIBE-CERT Early Warning - CVE-2026-21656](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2026-21656)
- [PT Security dbugs - PT-2026-22322 Johnson Controls Quantum HD](https://dbugs.ptsecurity.com/vulnerability/PT-2026-22322)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5924