Login Request a demo
Critical severity · published Mar 12, 2026
CVE-2026-3611
Honeywell IQ4x BMS Controller Missing authentication for critical function
10.0
CVSS
5.6%
EPSS
No
On KEV
Description
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)5.6% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IQ
IQ3 · Honeywell
v3.50_3.44 through 4.36 (build 4.3.7.9) · source: vendor
IQ
IQ412 · Honeywell
v3.50_3.44 through 4.36 (build 4.3.7.9) · source: vendor
IQ
IQ41x · Honeywell
v3.50_3.44 through 4.36 (build 4.3.7.9) · source: vendor
IQ
IQ422 · Honeywell
v3.50_3.44 through 4.36 (build 4.3.7.9) · source: vendor
IQ
IQ4E · Honeywell
v3.50_3.44 through 4.36 (build 4.3.7.9) · source: vendor
IQ
IQ4NC · Honeywell
v3.50_3.44 through 4.36 (build 4.3.7.9) · source: vendor
IQ
IQECO · Honeywell
v3.50_3.44 through 4.36 (build 4.3.7.9) · source: vendor
IF
Iq412 Firmware · Honeywell
before 3.30 · source: NVD
IF
Iq41x Firmware · Honeywell
before 3.30 · source: NVD
IF
Iq422 Firmware · Honeywell
before 3.30 · source: NVD
IF
Iq4e Firmware · Honeywell
before 3.30 · source: NVD
IF
Iq4nc Firmware · Honeywell
before 3.30 · source: NVD
In the news
VulnerabilityCritical
Honeywell IQ4x BMS Controller
View CSAF Summary Successful exploitation of this vulnerability could allow an unauthorized attacker to access controller management settings, control components, disclose information, or cause a denial-of-service condition. The following versions of Honeywell IQ4x BMS Controller are affected: IQ4E >=Firmware_v3.50_3.44|<4.36_build_4.3.7.9 (CVE-2026-3611) IQ412 >=Firmware_v3.50_3.44|<4.36_build_4.3.7.9 (CVE-2026-3611) IQ422 >=Firmware_v3.50_3.44|<4.36_build_4.3.7.9 (CVE-2026-3611) IQ4NC >=Firmware_v3.50_3.44|<4.36_build_4.3.7.9 (CVE-2026-3611) IQ41x >=Firmware_v3.50_3.44|<4.36_build_4.3.7.9 (CVE-2026-3611) IQ3 >=Firmware_v3.50_3.44|<4.36_build_4.3.7.9 (CVE-2026-3611) IQECO >=Firmware_v3.50_3.44|<4.36_build_4.3.7.9 (CVE-2026-3611) CVSS Vendor Equipment Vulnerabilities v3 10 Honeywell Honeywell IQ4x BMS Controller Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing, Government Services and Facilities, Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-3611 The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by desi...
CVE-2026-3611
Mar 10, 2026·CISA Advisories
Affected product
IQ
IQ3
Honeywell
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3611
Issue Tracking
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-03.json
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-03
Product
https://www.honeywell.com/us/en/contact