An OS Command Injection flaw allows an attacker to inject and execute arbitrary operating‑system commands on Johnson Controls Frick Controls Quantum HD before any authentication occurs. The vulnerability is categorized as CWE‑78 and can compromise the device’s integrity and confidentiality. The flaw arises from insufficient validation of certain input parameters.

Johnson Controls Frick Controls Quantum HD versions 10.22 and older are affected. The product is identified by the vendor Johnson Controls and the model Frick Controls Quantum HD.

The CVSS base score of 8.8 denotes high severity. EPSS indicates a very low exploitation probability (<1%), and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote and unauthenticated, requiring the attacker to reach a vulnerable interface exposed to external traffic.