CVE-2026-21654: Pre-Authentication OS Command Injection in Johnson Controls Frick Controls Quantum HD (10.22 through 11)

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6029 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Quantum HD Web Interface Command Injection / Path Traversal (CVE-2026-21654)

Detects OS command-injection metacharacter chains (;, |, &&, $(...) followed by sh, wget, nc, etc.) or relative path traversal in HTTP requests to Frick Controls Quantum HD controllers. CVE-2026-21654 (CWE-78) is pre-authentication, so any such request to the controller web interface is high-signal. Requires the quantum_hd_assets.csv lookup of controller IPs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T1083, T1005
• Data sources: zeek:http (bro:http:json), quantum_hd_assets.csv lookup
• Severity: critical
• Confidence: medium

Splunk SPL

index=zeek earliest=-24h sourcetype="bro:http:json" ```CVE-2026-21654 Frick Controls Quantum HD pre-auth OS command injection (TL-2026-6029)```
| rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip
| lookup quantum_hd_assets.csv ip AS dest_ip OUTPUT asset_name
| where isnotnull(asset_name)
| eval req=urldecode(coalesce(uri,"")." ".coalesce(post_body,""))
| eval cmd_inject=if(match(req,"(?i)(;|[|]|&&|[$]\x28|%60|\x60)\s*(sh|bash|busybox|nc|ncat|wget|curl|tftp|telnet|cat|id|whoami|uname|chmod|ping)(?=\s|$|[;|&<>])"),1,0)
| eval path_traversal=if(match(req,"(?i)([.][.]/){2,}|%2e%2e|/etc/(passwd|shadow)|/proc/self/"),1,0)
| where cmd_inject=1 OR path_traversal=1
| stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods values(uri) as uris values(user_agent) as user_agents values(status_code) as status_codes max(cmd_inject) as cmd_inject max(path_traversal) as path_traversal by src_ip dest_ip asset_name
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let qhd = _GetWatchlist('QuantumHD') | project SearchKey;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (qhd)
| extend req = url_decode(strcat(RequestURL, " ", AdditionalExtensions))
| extend CmdInject = req matches regex @"(?i)(;|\||&&|\$\(|%60|`)\s*(sh|bash|busybox|nc|ncat|wget|curl|tftp|telnet|cat|id|whoami|uname|chmod|ping)(?:\s|$|[;|&<>])"
| extend PathTraversal = req matches regex @"(?i)(\.\./){2,}|%2e%2e|/etc/(passwd|shadow)|/proc/self/"
| where CmdInject or PathTraversal
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL, DeviceVendor, DeviceProduct, CmdInject, PathTraversal

Sigma

title: Quantum HD Web Interface Command Injection or Path Traversal (CVE-2026-21654)
id: 6f1d2a3e-5b7c-4e18-9a21-3c4d5e6f7a01
status: experimental
description: Detects command-injection metacharacter chains or path traversal in requests to the Frick Controls Quantum HD web interface (pre-auth CWE-78 CVE-2026-21654, sibling CVE-2026-21659).
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21654
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.initial-access
    - attack.execution
    - attack.discovery
    - attack.collection
    - attack.t1190
    - attack.t1059
    - attack.t1083
    - attack.t1005
    - cve.2026.21654
    - cve.2026.21659
logsource:
    category: webserver
detection:
    selection_cmd:
        c-uri|re: '(?i)(;|%3b|%7c|%26%26|&&|\$\(|%24%28|%60|`|\|)(\s|%20|\+)*(sh|bash|busybox|nc|ncat|wget|curl|tftp|telnet|cat|id|whoami|uname|chmod|ping)(\s|%20|\+|$|;|%3b|&|%26|\||%7c)'
    selection_trav:
        c-uri|re: '(?i)((\.\./|%2e%2e(/|%2f)|\.\.%2f){2,}|/etc/(passwd|shadow)|/proc/self/)'
    condition: 1 of selection_*
falsepositives:
    - Authorized vulnerability scanning of controllers
    - Engineering tools sending parameter values with shell-like characters
level: critical

Known false positives:

• Authorized vulnerability scanners or pentest tooling sending injection test strings to controllers
• Engineering tools passing legitimate parameter values containing semicolons or pipes followed by words such as id or cat

Tuning notes: Populate quantum_hd_assets.csv (columns ip, asset_name) with all Quantum HD controllers. Exclude scanner source IPs. Enable post_body logging in Zeek for POST-based injection coverage. Tighten the command list once normal parameter values are baselined.

• 🔒 Path Traversal Against Quantum HD Web Interface (CVE-2026-21659 chain) · unlock with TL Creds
• 🔒 Credential and Configuration File Read on Controller Host · unlock with TL Creds
• 🔒 Reverse Shell or Tool Download Command on Controller Host · unlock with TL Creds
• 🔒 Code Injection Patterns in Quantum HD Web Requests (CVE-2026-21656/21657/21658) · unlock with TL Creds
• 🔒 Untrusted Source Accessing Quantum HD Web Interface · unlock with TL Creds
• 🔒 Controller Outbound Connection to Common Reverse-Shell or C2 Ports · unlock with TL Creds
• 🔒 Shell or Interpreter Spawned by Controller Web Service · unlock with TL Creds
• 🔒 Quantum HD Controller Initiating Outbound Connections to Non-Private Addresses · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-6029.

Technical analysis

CVE-2026-21654 affects the Frick Controls Quantum HD, an industrial refrigeration controller (Johnson Controls, Inc.) used for compressors and ancillary equipment in cold storage, food processing and pharmaceutical manufacturing. Insufficient validation of input in certain parameters can be reached before authentication and may permit unexpected actions; the CVE record classifies it as OS command injection (CWE-78, CAPEC-88) and titles it an unauthenticated remote code execution. CISA scores it CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the CVE record also carries a CVSS v4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). CISA's ADP SSVC entry lists Exploitation: none, Automatable: yes, Technical Impact: total.

The flaw was reported to CISA by Noam Moshe of Claroty Research Team 82 and disclosed in CISA ICS advisory ICSA-26-057-01 together with five sibling flaws in the same product: CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection, CVSS 9.1 each), CVE-2026-21659 (CWE-23 relative path traversal, CVSS 7.5) and CVE-2026-21660 (plaintext/hardcoded password storage, CVSS 6.2, local vector). CISA's advisory lists affected versions as 10.22 and earlier; the vendor/Claroty wording is versions 10.22 through 11, described as legacy platforms that reached end of support.

Per the 1898 & Co. (Burns & McDonnell) analysis, exploitation needs only network reachability to the device web interface, with no credentials or user interaction, and the injected commands run with the privileges of the underlying process (likely root-equivalent). That analysis describes possible impact as arbitrary file reads/writes, changes to refrigeration control parameters and safety limits, persistent backdoors and pivoting into OT/IT networks, with physical consequences such as compressor damage, refrigerant release and product spoilage. These impacts are the analyst's assessment, not observed activity. No public exploitation, PoC or exploit code has been reported: CISA states no known public exploitation was reported at publication, and VulDB reports no exploit exists (EPSS about 0.15%). The CVE is not stated to be in CISA KEV in any source reviewed. No IOCs, C2 infrastructure or threat-actor attribution have been published.

Remediation: upgrade to Quantum HD Unity version 12 or higher, then verify full compliance with the hardening guide and apply all recommended security configurations; see Johnson Controls advisory JCI-PSA-2026-05. CISA recommends minimizing network exposure, keeping control systems off the internet, isolating control networks behind firewalls, and using updated VPNs for remote access. One aggregator (cvefeed) states a fix of 10.23 or later; this conflicts with vendor, CISA and Claroty guidance and is not used here.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Credentials In Files

Remediation

Patches

• Upgrade to Frick Controls Quantum HD Unity version 12 or higher using the vendor's software update procedure
• Johnson Controls Product Security Advisory JCI-PSA-2026-05

Immediate actions

• Identify all Frick Controls Quantum HD controllers (versions 10.22 through 11) and confirm none are reachable from the internet, business networks or remote-access paths
• Isolate controllers on dedicated OT segments behind industrial firewalls and block access from IT networks
• Require an updated VPN with strong MFA for any remote access; prohibit direct external access until patched
• Log access attempts to controller interfaces and monitor for anomalous HTTP traffic, unexpected command execution and new outbound connections from controllers

Workarounds

• No vendor workaround is documented; reduce exposure through network segmentation, firewalling and VPN-only remote access until the upgrade is complete
• After upgrading to v12, verify compliance with the hardening guide and apply all recommended security configurations

Longer-term hardening

• Retire end-of-support Quantum HD 10.22-11 platforms by migrating to Quantum HD Unity v12 or later
• Perform impact analysis and risk assessment before deploying defensive measures, per CISA ICS guidance
• Validate after upgrade that injectable parameters and embedded credentials are remediated

Affected and fixed versions

• Johnson Controls, Inc. — Frick Controls Quantum HD
  Vulnerable versions: 10.22 and earlier (CISA); 10.22 through 11 (vendor/Claroty, end-of-support)
  Fixed in: Quantum HD Unity version 12 or later

Timeline

• 2026-01-02 CVE-2026-21654 reserved in the CVE Program.
• 2026-02-26 CISA releases ICS advisory ICSA-26-057-01 (Revision 1) covering six Frick Controls Quantum HD CVEs reported by Noam Moshe of Claroty Team82; the CVE record lists the same date as public.
• 2026-02-27 CVE-2026-21654 published to the NVD / CVE List.
• 2026-03-02 NVD record for CVE-2026-21654 last modified (per aggregator reporting).
• 2026-03-06 1898 & Co. publishes analysis of the pre-authentication flaws in the Quantum HD refrigeration controller; the CVE record is also updated on this date.
• 2026-04-29 1898 & Co. analysis page modified; still reports no observed in-the-wild exploitation.

Sources cited

• CISA ICS Advisory ICSA-26-057-01: Johnson Controls Frick Controls Quantum HD CISA · Government advisory · 2026-02-26
• Claroty Team82 Disclosure Dashboard - CVE-2026-21654 es.claroty.com · Advisory
• CVE Record CVE-2026-21654 (CVE Program / CISA ADP) MITRE · Advisory · 2026-02-27
• NVD - CVE-2026-21654 NVD (NIST) · Advisory · 2026-02-27
• INCIBE-CERT Early Warning - CVE-2026-21654 incibe.es · Advisory
• 1898 & Co.: Johnson Controls Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD Industrial Refrigeration Controller 1898advisories.burnsmcd.com · Research · 2026-03-06
• Johnson Controls Security Advisories (JCI-PSA-2026-05) johnsoncontrols.com · Vendor report
• VulDB entry 348162: Frick Controls Quantum HD up to 10.22 OS command injection vuldb.com · Research
• SentinelOne Vulnerability Database - CVE-2026-21654 SentinelOne · Research
• CISA CSAF file icsa-26-057-01 GitHub · Code repository · 2026-02-26

More in vulnerability

• FreeRDP client-side RCE chain (CVE-2026-91964 heap overflow + CVE-2026-91963 USB redirection heap disclosure) found via AI-agent vulnerability research workflow
• Ivanti EPM Core Critical SQL Injection Enabling Unauthenticated RCE (CVE-2026-121653) and Multiple Ivanti CSA/EPMM/Sentry/UWM Flaws
• UnrealIRCd labeled-response IRCv3 label tag injection (CVE-2026-114713) exploited in the wild
• LiteLLM semantic cache tenant isolation bypass (CVE-2026-89032)
• PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)

Related coverage of this activity

• Frick Controls Quantum HD RCE
• Frick Quantum HD command injection
• Frick Quantum HD flaw

Other reports on CVE-2026-21654

• CVE-2026-21659 — Johnson Controls Frick Controls Quantum HD unauthenticated path traversal / local file inclusion leading to arbitrary code execution

Previous and next in vulnerability

• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (ICSA-26-057-01) Previous report
• CVE-2026-25196: OS Command Injection in Copeland XWEB Pro (1.12.1 and prior) via Wi-Fi SSID/Password Fields Next report