Read the docs

Johnson Controls

Records126All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical25CVSS 9.0–10.0
CVSS high65CVSS 7.0–8.9

Exploited now

Johnson Controls records in CISA KEV

No Johnson Controls vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Metasys Extended Application And Data Server 11 records MEDIUM Metasys Application And Data Server 10 records MEDIUM Metasys Open Application Server 10 records MEDIUM Exacqvision Web Service 8 records MEDIUM Frick Controls Quantum Hd Firmware 6 records MEDIUM Exacqvision Server 4 records MEDIUM Metasys System Configuration Tool 4 records MEDIUM C-cure 9000 Firmware 3 records MEDIUM

Records

6 records in Frick Controls Quantum Hd Firmware · all components

TI-2026-17437 CVE-2026-21654 · GHSA-xmw3-64p4-g77h

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Priority MEDIUM 49

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.01661 Published 2026-02-27 No fix listed CWE-78
TI-2026-17442 CVE-2026-21659 · GHSA-7qxc-43wm-v793

Path traversal in Johnson Controls Frick Controls Quantum HD

Priority MEDIUM 48

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code o…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01045 Published 2026-02-27 No fix listed CWE-23
TI-2026-17441 CVE-2026-21658 · GHSA-9crv-fj8p-224j

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Priority MEDIUM 47

Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00712 Published 2026-02-27 No fix listed CWE-94
TI-2026-17443 CVE-2026-21660 · GHSA-2f5g-m75x-xphf

Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware

Priority LOW 30

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitiv…

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00264 Published 2026-02-27 No fix listed CWE-256
Open these records in search →