CVE-2026-21660: Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-27 · updated 2026-08-24
Weakness: CWE-256

Description

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.

Affected products

Johnson Controls Frick Controls Quantum HD: through 10.22

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Get alerted when CVE-2026-21660 or the next vulnerability affects your stack