VULNERABILITY INTELLIGENCE

CVE-2026-21656

CVSS score9.8 CRITICAL

EPSS probability0.45%

CISA KEVNot currently listed

Published2026-02-27

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

Weakness classification

productsecurity@jci.com: CWE-94

Primary references

productsecurity@jci.com — Third Party Advisory, US Government Resource
productsecurity@jci.com — Vendor Advisory