CVE-2026-21654

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

State: Published
Severity: 8.8 High
Published: Feb 27, 2026
Updated: Mar 6, 2026
Reserved: Jan 2, 2026

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N	jci

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Frick Controls Quantum HDJohnson Controls	Frick Controls Quantum HD version 10.22 and priorAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.