Vulnerability · Published Mar 12, 2026 · Assigned by icscert
CVE-2026-3611Honeywell IQ4x BMS Controller Missing authentication for critical function
Critical 10.0
In plain English
A critical-severity missing authentication in IQ3 from Honeywell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.7% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Honeywell | IQ4E | v3.50_3.44 – through 4.36 (build 4.3.7.9) |
| Honeywell | IQ412 | v3.50_3.44 – through 4.36 (build 4.3.7.9) |
| Honeywell | IQ422 | v3.50_3.44 – through 4.36 (build 4.3.7.9) |
| Honeywell | IQ4NC | v3.50_3.44 – through 4.36 (build 4.3.7.9) |
| Honeywell | IQ41x | v3.50_3.44 – through 4.36 (build 4.3.7.9) |
| Honeywell | IQ3 | v3.50_3.44 – through 4.36 (build 4.3.7.9) |
| Honeywell | IQECO | v3.50_3.44 – through 4.36 (build 4.3.7.9) |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H