CVE-2026-21659

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23 CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-21669.8A security vulnerability has been detected in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the f CVE-2026-216609.8A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quan CVE-2026-216618.4An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Sea CVE-2026-216629.8Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This is CVE-2026-216636.1HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An CVE-2026-216646.1HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Rev CVE-2026-216657.7The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.31 CVE-2026-216668.8A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-216678.8A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-216686.5A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.CVE-2026-216699.9A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-21678.8A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/