by Kastro
Paper/Archive/CVE-2026-21660

CVE-2026-21660

Johnson Controls Frick Controls Quantum HD — Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 18.2.182 × 203.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.

Affected

ProductAffectedFixed inSource
Frick Controls Quantum HDFrick Controls Quantum HD version 10.22 and prior–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
jci (CNA)6.9CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcisa.gov/news-events/ics-advisories/icsa-26-057-01refjohnsoncontrols.com/trust-center/cybersecurity/security-advisories