CVE-2026-3611: Honeywell IQ4x BMS Controller Missing authentication for critical function

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-12 · updated 2026-06-17
Weakness: CWE-306

Description

The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.

Affected products

Honeywell Iq412 Firmware: before 3.30 — fixed in 3.30
Honeywell Iq41X Firmware: before 3.30 — fixed in 3.30
Honeywell Iq422 Firmware: before 3.30 — fixed in 3.30
Honeywell Iq4E Firmware: before 3.30 — fixed in 3.30
Honeywell Iq4Nc Firmware: before 3.30 — fixed in 3.30

How to fix

Upgrade to a fixed version: Honeywell Iq412 Firmware 3.30; Honeywell Iq41X Firmware 3.30; Honeywell Iq422 Firmware 3.30; Honeywell Iq4E Firmware 3.30; Honeywell Iq4Nc Firmware 3.30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-3611 or the next vulnerability affects your stack