CVE-2026-21659

CRITICAL

9.8

Beschreibung

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht2/27/2026

Zuletzt geandert3/2/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

johnsoncontrols:frick_controls_quantum_hdjohnsoncontrols:frick_controls_quantum_hd_firmware

Schwachen (CWE)

CWE-23CWE-22

Referenzen

https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01(productsecurity@jci.com)

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories(productsecurity@jci.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.