Honeywell IQ4x BMS Controller Missing authentication for critical function
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Honeywell | IQ4E | v3.50_3.44 – 4.36 (build 4.3.7.9) | — | No fix listed | CNA |
| Honeywell | IQ412 | v3.50_3.44 – 4.36 (build 4.3.7.9) | — | No fix listed | CNA |
| Honeywell | IQ422 | v3.50_3.44 – 4.36 (build 4.3.7.9) | — | No fix listed | CNA |
| Honeywell | IQ4NC | v3.50_3.44 – 4.36 (build 4.3.7.9) | — | No fix listed | CNA |
| Honeywell | IQ41x | v3.50_3.44 – 4.36 (build 4.3.7.9) | — | No fix listed | CNA |
| Honeywell | IQ3 | v3.50_3.44 – 4.36 (build 4.3.7.9) | — | No fix listed | CNA |
| Honeywell | IQECO | v3.50_3.44 – 4.36 (build 4.3.7.9) | — | No fix listed | CNA |
- IQ4E VendorHoneywell Affected v3.50_3.44 – 4.36 (build 4.3.7.9) Fixed in — No fix listed CNA
- IQ412 VendorHoneywell Affected v3.50_3.44 – 4.36 (build 4.3.7.9) Fixed in — No fix listed CNA
- IQ422 VendorHoneywell Affected v3.50_3.44 – 4.36 (build 4.3.7.9) Fixed in — No fix listed CNA
- IQ4NC VendorHoneywell Affected v3.50_3.44 – 4.36 (build 4.3.7.9) Fixed in — No fix listed CNA
- IQ41x VendorHoneywell Affected v3.50_3.44 – 4.36 (build 4.3.7.9) Fixed in — No fix listed CNA
- IQ3 VendorHoneywell Affected v3.50_3.44 – 4.36 (build 4.3.7.9) Fixed in — No fix listed CNA
- IQECO VendorHoneywell Affected v3.50_3.44 – 4.36 (build 4.3.7.9) Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:honeywell:iq4e_firmware:*:*:*:*:*:*:*:* | before 3.30 | Vulnerable | Honeywell |
| cpe:2.3:h:honeywell:iq4e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Honeywell |
| cpe:2.3:o:honeywell:iq412_firmware:*:*:*:*:*:*:*:* | before 3.30 | Vulnerable | Honeywell |
| cpe:2.3:h:honeywell:iq412:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Honeywell |
| cpe:2.3:o:honeywell:iq422_firmware:*:*:*:*:*:*:*:* | before 3.30 | Vulnerable | Honeywell |
| cpe:2.3:h:honeywell:iq422:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Honeywell |
| cpe:2.3:o:honeywell:iq4nc_firmware:*:*:*:*:*:*:*:* | before 3.30 | Vulnerable | Honeywell |
| cpe:2.3:h:honeywell:iq4nc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Honeywell |
| cpe:2.3:o:honeywell:iq41x_firmware:*:*:*:*:*:*:*:* | before 3.30 | Vulnerable | Honeywell |
| cpe:2.3:h:honeywell:iq41x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Honeywell |
- cpe:2.3:o:honeywell:iq4e_firmware:*:*:*:*:*:*:*:* Versions before 3.30 Vulnerable ·Honeywell
- cpe:2.3:h:honeywell:iq4e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell
- cpe:2.3:o:honeywell:iq412_firmware:*:*:*:*:*:*:*:* Versions before 3.30 Vulnerable ·Honeywell
- cpe:2.3:h:honeywell:iq412:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell
- cpe:2.3:o:honeywell:iq422_firmware:*:*:*:*:*:*:*:* Versions before 3.30 Vulnerable ·Honeywell
- cpe:2.3:h:honeywell:iq422:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell
- cpe:2.3:o:honeywell:iq4nc_firmware:*:*:*:*:*:*:*:* Versions before 3.30 Vulnerable ·Honeywell
- cpe:2.3:h:honeywell:iq4nc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell
- cpe:2.3:o:honeywell:iq41x_firmware:*:*:*:*:*:*:*:* Versions before 3.30 Vulnerable ·Honeywell
- cpe:2.3:h:honeywell:iq41x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3611
- 2026-10-03 Alias added: GHSA-3p4g-vg78-jqrv
- 2026-10-25 EPSS moved to the 90th–95th percentile
References
Sources
- CVE-2026-3611 · CVE Program
- CVE-2026-3611 · NVD
- FIRST EPSS
- GHSA-3p4g-vg78-jqrv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences