Johnson Controls, Inc. Frick Controls Quantum HD
Johnson Controls Frick Controls Quantum HD (versions ≤10.22) contains six critical vulnerabilities enabling pre-authentication remote code execution, information disclosure, and denial of service attacks. The flaws include OS command injection, code injection, path traversal, and hardcoded credentials, affecting legacy systems deployed worldwide in food, agriculture, and other critical infrastructure sectors. Vendors recommend upgrading to Quantum HD Unity version 12 or higher.
Summary
Johnson Controls Frick Controls Quantum HD (versions ≤10.22) contains six critical vulnerabilities enabling pre-authentication remote code execution, information disclosure, and denial of service attacks. The flaws include OS command injection, code injection, path traversal, and hardcoded credentials, affecting legacy systems deployed worldwide in food, agriculture, and other critical infrastructure sectors. Vendors recommend upgrading to Quantum HD Unity version 12 or higher.
Indicators of Compromise
- cve — CVE-2026-21654
- cve — CVE-2026-21656
- cve — CVE-2026-21657
- cve — CVE-2026-21658
- cve — CVE-2026-21659
- cve — CVE-2026-21660