{"id":"CVE-2026-21659","state":"PUBLISHED","title":"Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion","description":"Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to\nexecute arbitrary code on the affected device, leading to full system compromise. \nThis issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.","publishedAt":"2026-02-27T09:08:50.498Z","updatedAt":"2026-03-06T18:40:42.670Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"jci"},"assigner":"jci","products":["Johnson Controls Frick Controls Quantum HD"],"affected":[{"vendor":"Johnson Controls","product":"Frick Controls Quantum HD","defaultStatus":"unaffected","versions":[{"version":"Frick Controls Quantum HD version 10.22 and prior","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01","https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"],"weaknesses":["CWE-23"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/21xxx/CVE-2026-21659.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-21659","state":"PUBLISHED","datePublished":"2026-02-27T09:08:50.498Z","dateUpdated":"2026-03-06T18:40:42.670Z","assignerShortName":"jci","assignerOrgId":"7281d04a-a537-43df-bfb4-fa4110af9d01","dateReserved":"2026-01-02T13:23:28.169Z"},"containers":{"cna":{"title":"Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion","descriptions":[{"lang":"en","value":"Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to\nexecute arbitrary code on the affected device, leading to full system compromise. \nThis issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior."}],"affected":[{"vendor":"Johnson Controls","product":"Frick Controls Quantum HD","defaultStatus":"unaffected","versions":[{"version":"Frick Controls Quantum HD version 10.22 and prior","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01"},{"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-23","description":"CWE-23: Relative Path Traversal","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"jci","orgId":"7281d04a-a537-43df-bfb4-fa4110af9d01","dateUpdated":"2026-02-27T09:27:51.944Z"},"credits":[{"lang":"en","type":"finder","value":"Noam Moshe of Claroty Team 82 Research group"}],"datePublic":"2026-02-26T08:59:00.000Z","impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"a. Quantum HD version 10.22 through Version 11 is a previous product platform and is End Of support platform and should be upgraded to new platform with Quantum HD Unity version 12 and above.  The update procedure can be found here: <a target=\"_blank\" rel=\"nofollow\" href=\"https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software..\">https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software...</a>.<br>b. After the upgrade to version 12 is completed, ensure full alignment with hardening guide and apply all relevant security configurations.<br>c. For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-05 at the following location<br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories\">https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories</a><br><br>"}],"value":"a. Quantum HD version 10.22 through Version 11 is a previous product platform and is End Of support platform and should be upgraded to new platform with Quantum HD Unity version 12 and above.  The update procedure can be found here:  https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-27T16:23:00.555872Z","id":"CVE-2026-21659","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-06T18:40:42.670Z"}}]}}}