Which versions of Frick Controls Quantum Hd Firmware are affected by CVE-2026-21660?

Frick Controls Quantum HD firmware versions 10.22 and prior contain hardcoded email credentials stored in plaintext, creating a critical risk of unauthorized system access and data exposure.

How to fix or mitigate CVE-2026-21660?

Within 24 hours: Identify all Frick Controls Quantum HD installations and document current firmware versions; restrict network access to affected systems to essential personnel only; begin credential rotation for all email accounts potentially affected. Within 7 days: Implement network segmentation to isolate affected systems from critical infrastructure; deploy enhanced monitoring for unauthorized access attempts; engage Frick Controls support for guidance on firmware upgrades or alternatives. Within 30 days: Deploy patched firmware versions once available from vendor; conduct forensic analysis of system logs for evidence of unauthorized access; implement secrets management solution for any replacement systems.

Frick Controls Quantum Hd Firmware CVE-2026-21660

Q: What is the CVSS score of CVE-2026-21660?

CVE-2026-21660 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Plaintext Storage of a Password (CWE-256)

2026-02-27 productsecurity@jci.com

Authentication Bypass Frick Controls Quantum Hd Firmware Johnsoncontrols

6.9

CVSS 4.0 · Vendor: jci

Severity by source

Vendor (jci) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (jci) · only source for this CVE.

CVSS VectorVendor: jci

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 24, 2026 - 18:22 NVD

CRITICAL MEDIUM

CVSS changed

Aug 24, 2026 - 18:22 NVD

9.8 (CRITICAL) 6.9 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 10:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.

AnalysisAI

Hardcoded email credentials stored as plaintext in Johnson Controls Frick Controls firmware. Sixth critical vulnerability — exposed credentials could enable account access and lateral movement.