CVE-2026-21660

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.

Score

CVSS 3.1 9.8 Critical

Status

Modified - productsecurity@jci.com

Published

2026-02-27

Last modified

2026-08-24

Weaknesses

CWE-256, CWE-522

Affected products

• Frick Controls Quantum Hd (Johnson Controls)
• Frick Controls Quantum Hd Firmware (Johnsoncontrols)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories