CVE-2026-3611: Honeywell IQ4 Series BMS Controller missing authentication in web HMI

CVE-2026-3611 · Severity: critical · CVSS 10 · Published 2026-03-12

Honeywell IQ4 series building management controllers, which manage critical infrastructure like heating and cooling, are vulnerable to complete unauthorized takeover in their default configuration. Because the devices ship without security enabled, any person who can reach the controller over the network can create their own administrative account. This allows an attacker to change building settings, view sensitive data, or lock out legitimate operators entirely, potentially disrupting facility operations.

Vendors: Honeywell.

Quick answers

Is CVE-2026-3611 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3611 being exploited in the wild.
How severe is CVE-2026-3611?
Critical severity, with a CVSS score of 10, published 12 March 2026.
Which products and versions are affected?
Honeywell Iq412 Firmware < 3.30; Honeywell Iq41x Firmware < 3.30; Honeywell Iq422 Firmware < 3.30; Honeywell Iq4e Firmware < 3.30; and 1 more.
Is there a fix for CVE-2026-3611?
A patch was published on 2026-03-26: Update A released with revised mitigation and version details Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3611 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-3611?
Check whether you run Honeywell Iq412, Honeywell Iq412 Firmware, Honeywell Iq41x or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Honeywell IQ4 series controllers (IQ4E, IQ412, IQ422, IQ4NC, IQ41x) suffer from a missing authentication vulnerability (CWE-306) in their factory-default state. By design, the system operates in a 'System Guest' context (level 100) with full read/write privileges until a user module is manually configured. An unauthenticated remote attacker can access the 'U.htm' page to create a new administrative account, which dynamically enables the user module and enforces authentication using the attacker's credentials. This results in a complete compromise of the controller and a permanent lockout of legitimate administrators. The issue is resolved in firmware version 3.30 and later, which forces the creation of a user module during commissioning.

Affected products

  • Honeywell IQ4E Firmware < 3.30
  • Honeywell IQ412 Firmware < 3.30
  • Honeywell IQ422 Firmware < 3.30
  • Honeywell IQ4NC Firmware < 3.30
  • Honeywell IQ41x Firmware < 3.30

Timeline

  • 2026-03-10: advisory: Initial CISA advisory release
  • 2026-03-12: disclosed: CVE published to NVD
  • 2026-03-26: patched: Update A released with revised mitigation and version details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.