CVE-2026-3611 Honeywell IQ4x BMS Controller Missing authentication for critical function
Remote attackers can create admin accounts on Honeywell IQ4x controllers due to missing authentication, locking out legitimate operators.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3611?
CVE-2026-3611 is a critical missing authorization vulnerability in Honeywell IQ3, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
Weakness: CWE-306
Which versions are affected by CVE-2026-3611?
It affects 5 products.
Products include Honeywell Iq412 Firmware, Honeywell Iq41x Firmware, Honeywell Iq422 Firmware, Honeywell Iq4e Firmware, Honeywell Iq4nc Firmware.
How do I fix CVE-2026-3611?
No fix has been published for CVE-2026-3611 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-3611 being exploited?
There is no known exploitation of CVE-2026-3611 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-3p4g-vg78-jqrv.