CVE-2026-3611
Published: 12 March 2026
Description
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write…
more
privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
Mitigating Controls (NIST 800-53 r5)AI
Directly identifies and limits actions permitted without identification or authentication, preventing unauthenticated access to the HMI and U.htm for user creation and configuration changes.
Requires unique identification and authentication for organizational users, enforcing authentication on the web HMI to block unauthenticated read/write privileges and account creation.
Mandates secure account management processes including approval for creation and privilege assignment, preventing attackers from creating administrative accounts via the accessible U.htm page.
Security SummaryAI
CVE-2026-3611 affects the Honeywell IQ4x building management controller, where the full web-based human-machine interface (HMI) is exposed without authentication in its factory-default configuration. Without a user module configured, security is disabled by design, allowing the system to operate under a System Guest (level 100) context that grants read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via the U.htm page, which remains accessible prior to any authentication setup.
A remote attacker with network access to the HTTP interface can exploit this vulnerability without authentication or privileges. By accessing U.htm, the attacker can create a new account with administrative read/write permissions, dynamically enabling the user module under attacker-controlled credentials. This grants the attacker full control over the controller's configuration and administration, potentially locking out legitimate operators from both local and web-based access.
CISA's ICS Advisory ICSA-26-069-03 details mitigation recommendations for this vulnerability, available at the provided references including the CSAF JSON file and CISA news event page. Honeywell contact information is also listed for further support.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated access to public-facing web HMI enables exploitation (T1190) and creation of local administrative accounts (T1136.001).