CVE-2026-21658: Frick Quantum HD Firmware RCE Vulnerability

CVE-2026-21658 Overview

CVE-2026-21658 is an unauthenticated remote code execution vulnerability affecting Johnson Controls Frick Controls Quantum HD industrial control systems. The vulnerability stems from improper control of code generation (CWE-94: Code Injection), where insufficient validation of input in certain parameters permits unexpected actions that could compromise the security of the device before authentication occurs.

This code injection vulnerability is particularly concerning in industrial control system (ICS) environments where Frick Controls Quantum HD units are deployed for refrigeration and HVAC control in critical infrastructure facilities. An attacker with network access can exploit this flaw without any authentication, potentially gaining control over the affected device.

Critical Impact

Unauthenticated attackers can inject and execute arbitrary code on vulnerable Frick Controls Quantum HD devices, potentially compromising industrial refrigeration and HVAC systems without any prior authentication.

Affected Products

• Johnson Controls Frick Controls Quantum HD Firmware version 10.22 and prior
• Johnson Controls Frick Controls Quantum HD Hardware
• All deployments running vulnerable firmware versions in network-accessible configurations

Discovery Timeline

• February 27, 2026 - CVE-2026-21658 published to NVD
• March 2, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21658

Vulnerability Analysis

This code injection vulnerability exists in the Johnson Controls Frick Controls Quantum HD firmware due to insufficient input validation in certain parameters. The flaw allows remote attackers to inject malicious code that the system executes without requiring authentication, making it particularly dangerous for internet-exposed or network-accessible devices.

The vulnerability impacts both the integrity and availability of affected systems, as indicated by the CVSS 4.0 vector showing high impacts on integrity (VI:H) and availability (VA:H). The attack requires no privileges and no user interaction, with low attack complexity over a network vector.

Industrial control systems like the Frick Controls Quantum HD are typically deployed in refrigeration facilities, cold storage warehouses, and HVAC systems for commercial and industrial applications. Successful exploitation could allow attackers to manipulate temperature controls, disrupt operations, or use the compromised device as a pivot point for further attacks within the operational technology (OT) network.

Root Cause

The root cause of CVE-2026-21658 is improper control of code generation, classified as CWE-94 (Code Injection). The vulnerable firmware fails to adequately validate and sanitize user-supplied input in certain parameters, allowing attackers to inject code that the system interprets and executes. This lack of input validation before authentication creates a pre-auth attack surface that can be exploited remotely.

Attack Vector

The attack vector for CVE-2026-21658 is network-based, requiring no authentication, no user interaction, and presenting low attack complexity. An attacker with network access to the Frick Controls Quantum HD device can send specially crafted requests containing malicious code payloads to vulnerable parameters.

The vulnerability can be exploited by sending crafted input to specific parameters in the device's network interface that are processed before authentication checks occur. Due to the insufficient input validation, the injected code is processed and executed by the system, granting the attacker the ability to perform unauthorized actions on the device.

For detailed technical information about exploitation methods, refer to the CISA ICS Advisory ICSA-26-057-01.

Detection Methods for CVE-2026-21658

Indicators of Compromise

• Unusual network traffic patterns to or from Frick Controls Quantum HD devices on non-standard ports or protocols
• Unexpected configuration changes or system behavior on Quantum HD controllers
• Anomalous command sequences or API calls to the device that deviate from normal operational patterns
• Evidence of unauthorized access attempts or successful authentications following exploitation

Detection Strategies

• Deploy network intrusion detection systems (NIDS) with rules to identify suspicious traffic patterns targeting Frick Controls Quantum HD devices
• Implement application-layer monitoring to detect malformed or unexpected input parameters in requests to Quantum HD controllers
• Configure SIEM alerts for authentication failures followed by successful actions on ICS devices, which may indicate pre-auth exploitation
• Use industrial protocol-aware monitoring solutions to baseline normal device communications and alert on deviations

Monitoring Recommendations

• Establish baseline network behavior for all Frick Controls Quantum HD devices and alert on anomalies
• Monitor system logs from Quantum HD controllers for signs of code execution or unexpected process activity
• Implement continuous asset inventory to identify all vulnerable firmware versions in the environment
• Enable verbose logging on network segments containing ICS devices and forward logs to centralized SIEM platforms

How to Mitigate CVE-2026-21658

Immediate Actions Required

• Identify all Frick Controls Quantum HD devices running firmware version 10.22 or earlier in your environment
• Isolate vulnerable devices from the internet and restrict network access using firewalls and network segmentation
• Apply the principle of least privilege to network access, ensuring only authorized systems can communicate with Quantum HD controllers
• Review the CISA ICS Advisory and Johnson Controls Security Advisory for vendor-specific guidance

Patch Information

Johnson Controls has released security advisories addressing this vulnerability. Organizations should consult the Johnson Controls Security Advisories page for the latest firmware updates and patching instructions. CISA has also issued ICS Advisory ICSA-26-057-01 with detailed mitigation recommendations.

Contact Johnson Controls support directly for firmware upgrade procedures and to confirm the availability of patched firmware versions for your specific Quantum HD deployment.

Workarounds

• Implement strict network segmentation to isolate Frick Controls Quantum HD devices from untrusted networks and the internet
• Deploy a VPN or other secure access mechanism for remote management of ICS devices rather than exposing them directly to the network
• Configure firewall rules to restrict inbound connections to Quantum HD devices to only known, trusted management systems
• Enable multi-factor authentication and access controls on all management interfaces where supported

# Example network segmentation using iptables (adapt to your environment)
# Restrict access to Quantum HD device on 192.168.100.10 to management VLAN only
iptables -A INPUT -d 192.168.100.10 -s 10.0.50.0/24 -j ACCEPT
iptables -A INPUT -d 192.168.100.10 -j DROP