Frick Controls Quantum HD: Unvalidated Input Allows Unauthorized Actions

Summary

The Frick Controls Quantum HD version 10.22 and earlier fails to properly check user input, allowing a potential attacker to execute unauthorized actions before the device's security checks. This could compromise the security of the device. Update to the latest version of Frick Controls Quantum HD to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
johnsoncontrols	frick_controls_quantum_hd_firmware	<= 10.22	–

Original title

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters m...

Original description

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

nvd CVSS3.1 9.8

nvd CVSS4.0 8.8

Vulnerability type

CWE-94 Code Injection

https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01 Third Party Advisory US Government Resource
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories Vendor Advisory