CVE-2026-3611

🗓️ 12 Mar 2026 20:06:05Reported by icscertType

cve🔗 web.nvd.nist.gov👁 96 Views🌐 WEB

Honeywell IQ4x controller exposes web HMI without authentication in factory default, enabling attacker account

Reporter	Title	Published	Views	Family All 15
attackerkb	CVE-2026-3611	12 Mar 202620:06	–	attackerkb
GithubExploit	building_automation_system_guardian	3 Aug 202602:31	–	githubexploit
BDU FSTEC	The vulnerability of Honeywell IQ4 programmable logic controllers’ microprogramming software lies in the lack of authentication for critical functions, allowing attackers to gain full access to the device.	17 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-3611	10 Mar 202611:00	–	circl
CNNVD	Honeywell IQ4x 访问控制错误漏洞	12 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-3611 Honeywell IQ4x BMS Controller Missing authentication for critical function	12 Mar 202620:06	–	cvelist
EUVD	EUVD-2026-11706	12 Mar 202621:34	–	euvd
ICS	Honeywell IQ4 Series BMS Controller (Update A)	10 Mar 202606:00	–	ics
Kitploit	BAS-Guardian — Updated!	2 Sep 202623:59	–	kitploit
NVD	CVE-2026-3611	12 Mar 202621:16	–	nvd

NVD

Vulners

Node

AND

honeywell iq4e_firmwareRange<3.30

honeywell iq4eMatch-

Node

AND

honeywell iq412_firmwareRange<3.30

honeywell iq412Match-

Node

AND

honeywell iq422_firmwareRange<3.30

honeywell iq422Match-

Node

AND

honeywell iq4nc_firmwareRange<3.30

honeywell iq4ncMatch-

Node

AND

honeywell iq41x_firmwareRange<3.30

honeywell iq41xMatch-

[
  {
    "vendor": "Honeywell",
    "product": "IQ4E",
    "versions": [
      {
        "status": "affected",
        "version": "v3.50_3.44",
        "lessThanOrEqual": "4.36 (build 4.3.7.9)",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Honeywell",
    "product": "IQ412",
    "versions": [
      {
        "status": "affected",
        "version": "v3.50_3.44",
        "lessThanOrEqual": "4.36 (build 4.3.7.9)",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Honeywell",
    "product": "IQ422",
    "versions": [
      {
        "status": "affected",
        "version": "v3.50_3.44",
        "lessThanOrEqual": "4.36 (build 4.3.7.9)",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Honeywell",
    "product": "IQ4NC",
    "versions": [
      {
        "status": "affected",
        "version": "v3.50_3.44",
        "lessThanOrEqual": "4.36 (build 4.3.7.9)",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Honeywell",
    "product": "IQ41x",
    "versions": [
      {
        "status": "affected",
        "version": "v3.50_3.44",
        "lessThanOrEqual": "4.36 (build 4.3.7.9)",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Honeywell",
    "product": "IQ3",
    "versions": [
      {
        "status": "affected",
        "version": "v3.50_3.44",
        "lessThanOrEqual": "4.36 (build 4.3.7.9)",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Honeywell",
    "product": "IQECO",
    "versions": [
      {
        "status": "affected",
        "version": "v3.50_3.44",
        "lessThanOrEqual": "4.36 (build 4.3.7.9)",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
cisa	www.cisa.gov/news-events/ics-advisories/icsa-26-069-03
github	www.github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-03.json
honeywell	www.honeywell.com/us/en/contact

Parameter	Position	Path	Description	CWE
Action	request body	/confirmAction.htm	Unauthenticated enabling of the User module by creating a new user strategy, enabling authentication and admin access.	CWE-306
ActionModuleEntireReference	request body	/confirmAction.htm	Unauthenticated enabling of the User module by creating a new user strategy, enabling authentication and admin access.	CWE-306
ActionFields	request body	/confirmAction.htm	Unauthenticated enabling of the User module by creating a new user strategy, enabling authentication and admin access.	CWE-306
ActionTextualPrompt	request body	/confirmAction.htm	Unauthenticated enabling of the User module by creating a new user strategy, enabling authentication and admin access.	CWE-306
ActionCompletionURL	request body	/confirmAction.htm	Unauthenticated enabling of the User module by creating a new user strategy, enabling authentication and admin access.	CWE-306
ActionRejectionURL	request body	/confirmAction.htm	Unauthenticated enabling of the User module by creating a new user strategy, enabling authentication and admin access.	CWE-306
ovrideStart	request body	/confirmAction.htm	Unauthenticated enabling of the User module by creating a new user strategy, enabling authentication and admin access.	CWE-306
ServerCommand	request body	/U.htm	Unauthenticated creation of credentials for a new administrative user via U.htm.	CWE-306
ModuleFullName	request body	/U.htm	Unauthenticated creation of credentials for a new administrative user via U.htm.	CWE-306
U0($)newVal	request body	/U.htm	Unauthenticated creation of credentials for a new administrative user via U.htm.	CWE-306

17 Jun 2026 10:43Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.110

CVSS 410

EPSS0.00986

SSVC

CWE-306