CVE-2026-21660CWE-256CWE-522

CVE-2026-21660

Critical · published February 27, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise

This issue affects Frick Controls Quantum HD version 10.22 and prior.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.1th percentile
Weaknesses
CWE-256 · Plaintext Storage of a Password; CWE-522 · Insufficiently Protected Credentials
Published
2026-02-27T15:16Z
Affected products (1)
ProductVersionsFixed in
johnsoncontrols/frick_controls_quantum_hd_firmware≤ 10.22—
References (2)
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01 · [email protected]https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories · [email protected]
EPSS history
Timeline
  • 27 FEB 09:18Z
    Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware
    cvelistv5