# CVE-2026-21654: Pre-Authentication OS Command Injection in Johnson Controls Frick Controls Quantum HD (10.22 through 11)

> CVE-2026-21654 is a critical (CVSS v3.1 9.1) pre-authentication OS command injection (CWE-78) in the network-facing interface of the Johnson Controls Frick Controls Quantum HD industrial refrigeration controller. Versions 10.22 through 11 are end-of-support; the vendor fix is to upgrade to Quantum HD Unity version 12 or later and apply the hardening guide.

- **Published:** 2026-11-14T03:17:30Z
- **Last reviewed:** 2026-11-14T03:17:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6029
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6029.png
- **ID:** TL-2026-6029
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2026-21654

## Description

CVE-2026-21654 affects the Frick Controls Quantum HD, an industrial refrigeration controller (Johnson Controls, Inc.) used for compressors and ancillary equipment in cold storage, food processing and pharmaceutical manufacturing. Insufficient validation of input in certain parameters can be reached before authentication and may permit unexpected actions; the CVE record classifies it as OS command injection (CWE-78, CAPEC-88) and titles it an unauthenticated remote code execution. CISA scores it CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the CVE record also carries a CVSS v4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). CISA's ADP SSVC entry lists Exploitation: none, Automatable: yes, Technical Impact: total.

The flaw was reported to CISA by Noam Moshe of Claroty Research Team 82 and disclosed in CISA ICS advisory ICSA-26-057-01 together with five sibling flaws in the same product: CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection, CVSS 9.1 each), CVE-2026-21659 (CWE-23 relative path traversal, CVSS 7.5) and CVE-2026-21660 (plaintext/hardcoded password storage, CVSS 6.2, local vector). CISA's advisory lists affected versions as 10.22 and earlier; the vendor/Claroty wording is versions 10.22 through 11, described as legacy platforms that reached end of support.

Per the 1898 & Co. (Burns & McDonnell) analysis, exploitation needs only network reachability to the device web interface, with no credentials or user interaction, and the injected commands run with the privileges of the underlying process (likely root-equivalent). That analysis describes possible impact as arbitrary file reads/writes, changes to refrigeration control parameters and safety limits, persistent backdoors and pivoting into OT/IT networks, with physical consequences such as compressor damage, refrigerant release and product spoilage. These impacts are the analyst's assessment, not observed activity. No public exploitation, PoC or exploit code has been reported: CISA states no known public exploitation was reported at publication, and VulDB reports no exploit exists (EPSS about 0.15%). The CVE is not stated to be in CISA KEV in any source reviewed. No IOCs, C2 infrastructure or threat-actor attribution have been published.

Remediation: upgrade to Quantum HD Unity version 12 or higher, then verify full compliance with the hardening guide and apply all recommended security configurations; see Johnson Controls advisory JCI-PSA-2026-05. CISA recommends minimizing network exposure, keeping control systems off the internet, isolating control networks behind firewalls, and using updated VPNs for remote access. One aggregator (cvefeed) states a fix of 10.23 or later; this conflicts with vendor, CISA and Claroty guidance and is not used here.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1005 Data from Local System
- T1552.001 Credentials In Files

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Quantum HD Web Interface Command Injection / Path Traversal (CVE-2026-21654)** (`TL-2026-6029-SPL-001`)

Detects OS command-injection metacharacter chains (;, |, &&, $(...) followed by sh, wget, nc, etc.) or relative path traversal in HTTP requests to Frick Controls Quantum HD controllers. CVE-2026-21654 (CWE-78) is pre-authentication, so any such request to the controller web interface is high-signal. Requires the quantum_hd_assets.csv lookup of controller IPs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1083, T1005
- **Data sources:** zeek:http (bro:http:json), quantum_hd_assets.csv lookup
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

````spl
index=zeek earliest=-24h sourcetype="bro:http:json" ```CVE-2026-21654 Frick Controls Quantum HD pre-auth OS command injection (TL-2026-6029)```
| rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip
| lookup quantum_hd_assets.csv ip AS dest_ip OUTPUT asset_name
| where isnotnull(asset_name)
| eval req=urldecode(coalesce(uri,"")." ".coalesce(post_body,""))
| eval cmd_inject=if(match(req,"(?i)(;|[|]|&&|[$]\x28|%60|\x60)\s*(sh|bash|busybox|nc|ncat|wget|curl|tftp|telnet|cat|id|whoami|uname|chmod|ping)(?=\s|$|[;|&<>])"),1,0)
| eval path_traversal=if(match(req,"(?i)([.][.]/){2,}|%2e%2e|/etc/(passwd|shadow)|/proc/self/"),1,0)
| where cmd_inject=1 OR path_traversal=1
| stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods values(uri) as uris values(user_agent) as user_agents values(status_code) as status_codes max(cmd_inject) as cmd_inject max(path_traversal) as path_traversal by src_ip dest_ip asset_name
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let qhd = _GetWatchlist('QuantumHD') | project SearchKey;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (qhd)
| extend req = url_decode(strcat(RequestURL, " ", AdditionalExtensions))
| extend CmdInject = req matches regex @"(?i)(;|\||&&|\$\(|%60|`)\s*(sh|bash|busybox|nc|ncat|wget|curl|tftp|telnet|cat|id|whoami|uname|chmod|ping)(?:\s|$|[;|&<>])"
| extend PathTraversal = req matches regex @"(?i)(\.\./){2,}|%2e%2e|/etc/(passwd|shadow)|/proc/self/"
| where CmdInject or PathTraversal
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL, DeviceVendor, DeviceProduct, CmdInject, PathTraversal
```

### Sigma

```yaml
title: Quantum HD Web Interface Command Injection or Path Traversal (CVE-2026-21654)
id: 6f1d2a3e-5b7c-4e18-9a21-3c4d5e6f7a01
status: experimental
description: Detects command-injection metacharacter chains or path traversal in requests to the Frick Controls Quantum HD web interface (pre-auth CWE-78 CVE-2026-21654, sibling CVE-2026-21659).
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21654
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.initial-access
    - attack.execution
    - attack.discovery
    - attack.collection
    - attack.t1190
    - attack.t1059
    - attack.t1083
    - attack.t1005
    - cve.2026.21654
    - cve.2026.21659
logsource:
    category: webserver
detection:
    selection_cmd:
        c-uri|re: '(?i)(;|%3b|%7c|%26%26|&&|\$\(|%24%28|%60|`|\|)(\s|%20|\+)*(sh|bash|busybox|nc|ncat|wget|curl|tftp|telnet|cat|id|whoami|uname|chmod|ping)(\s|%20|\+|$|;|%3b|&|%26|\||%7c)'
    selection_trav:
        c-uri|re: '(?i)((\.\./|%2e%2e(/|%2f)|\.\.%2f){2,}|/etc/(passwd|shadow)|/proc/self/)'
    condition: 1 of selection_*
falsepositives:
    - Authorized vulnerability scanning of controllers
    - Engineering tools sending parameter values with shell-like characters
level: critical

```

**Known false positives:**

- Authorized vulnerability scanners or pentest tooling sending injection test strings to controllers
- Engineering tools passing legitimate parameter values containing semicolons or pipes followed by words such as id or cat

**Tuning notes:** Populate quantum_hd_assets.csv (columns ip, asset_name) with all Quantum HD controllers. Exclude scanner source IPs. Enable post_body logging in Zeek for POST-based injection coverage. Tighten the command list once normal parameter values are baselined.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Path Traversal Against Quantum HD Web Interface (CVE-2026-21659 chain) (locked: unlock with TL Creds)
- Credential and Configuration File Read on Controller Host (locked: unlock with TL Creds)
- Reverse Shell or Tool Download Command on Controller Host (locked: unlock with TL Creds)
- Code Injection Patterns in Quantum HD Web Requests (CVE-2026-21656/21657/21658) (locked: unlock with TL Creds)
- Untrusted Source Accessing Quantum HD Web Interface (locked: unlock with TL Creds)
- Controller Outbound Connection to Common Reverse-Shell or C2 Ports (locked: unlock with TL Creds)
- Shell or Interpreter Spawned by Controller Web Service (locked: unlock with TL Creds)
- Quantum HD Controller Initiating Outbound Connections to Non-Private Addresses (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CISA ICS Advisory ICSA-26-057-01: Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-21654](https://es.claroty.com/team82/disclosure-dashboard/cve-2026-21654)
- [CVE Record CVE-2026-21654 (CVE Program / CISA ADP)](https://cveawg.mitre.org/api/cve/CVE-2026-21654)
- [NVD - CVE-2026-21654](https://nvd.nist.gov/vuln/detail/CVE-2026-21654)
- [1898 & Co.: Johnson Controls Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD Industrial Refrigeration Controller](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [CISA CSAF file icsa-26-057-01](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-01.json)
- [Johnson Controls Security Advisories (JCI-PSA-2026-05)](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [VulDB entry 348162: Frick Controls Quantum HD up to 10.22 OS command injection](https://vuldb.com/vuln/348162)
- [SentinelOne Vulnerability Database - CVE-2026-21654](https://www.sentinelone.com/vulnerability-database/cve-2026-21654/)
- [INCIBE-CERT Early Warning - CVE-2026-21654](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2026-21654)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6029