9.8criticalCritical
CVE-2026-21660
Johnsoncontrols Frick Controls Quantum Hd Firmware
A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.
Exploitation status
- A vendor advisory or patch reference has been published.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, no special conditions are needed to exploit it.
- To exploit it, no account is needed.
- Beyond that, no action by a user is required.
Scoring
- CVSS
- 9.8 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- CVSS v4
- 6.9
- Weakness
- CWE-256
- Assigned by
- productsecurity@jci.com
Dates
- Published
- 2026-02-27
- Last modified
- 2026-08-24
- Sources
- NVD
Affected products
- Johnsoncontrols Frick Controls Quantum Hd Firmware- 10.22
- Johnsoncontrols Frick Controls Quantum Hdall versions
As listed in the NVD configuration data. Not a statement about your estate.