CVE-2026-3611: Honeywell IQ4x Auth Bypass Vulnerability

CVE-2026-3611 Overview

CVE-2026-3611 is a critical authentication bypass vulnerability affecting the Honeywell IQ4x building management controller. The device exposes its full web-based Human-Machine Interface (HMI) without authentication in its factory-default configuration. When no user module is configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface.

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). Authentication controls are only enforced after a web user is created via the U.htm endpoint, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote attacker can create a new account with administrative read/write permissions, enabling the user module and imposing authentication under attacker-controlled credentials.

Critical Impact
This vulnerability allows unauthenticated remote attackers to gain full administrative control over building management systems, potentially locking out legitimate operators from local and web-based configuration while enabling manipulation of critical building infrastructure.

Affected Products

Honeywell IQ4x Building Management Controller (factory-default configuration)
Honeywell IQ4x devices with no user module configured
Honeywell IQ4x systems accessible via HTTP interface without authentication

Discovery Timeline

2026-03-12 - CVE-2026-3611 published to NVD
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3611

Vulnerability Analysis

This vulnerability represents a fundamental design flaw in the Honeywell IQ4x building management controller's authentication architecture. The device ships with security disabled by default, operating under a System Guest context with elevated privileges (level 100). This means any network-adjacent or internet-exposed device immediately grants read/write access to its entire configuration interface without requiring credentials.

The root of the issue lies in the conditional authentication model where the user module remains dormant until explicitly activated through the U.htm endpoint. This creates a critical window of exposure during initial deployment and affects any device that has been reset to factory defaults.

Root Cause

The vulnerability stems from an insecure default configuration (CWE-306: Missing Authentication for Critical Function). The Honeywell IQ4x controller was designed with a security model that assumes administrators will create user accounts immediately upon deployment. However, this assumption fails in practice as:

The device is fully functional without any authentication configured
The U.htm user creation endpoint is accessible to any party with network access
No warnings or forced authentication setup exists during initial deployment
The System Guest context provides excessive default privileges

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who can reach the HTTP interface of a vulnerable Honeywell IQ4x controller can exploit this vulnerability through the following attack pattern:

The attacker identifies an exposed Honeywell IQ4x controller on the network or internet
Without authentication, the attacker accesses the web-based HMI with full read/write privileges
The attacker navigates to the U.htm endpoint to create a new administrative account
Upon account creation, the user module is automatically enabled
The attacker's credentials become the controlling authentication mechanism
Legitimate operators are effectively locked out from local and web-based administration

This vulnerability is particularly dangerous in industrial control system (ICS) and operational technology (OT) environments where building management controllers may control HVAC, lighting, access control, and other critical building infrastructure.

Detection Methods for CVE-2026-3611

Indicators of Compromise

Unexpected user accounts created on Honeywell IQ4x controllers
Authentication suddenly enabled on previously unauthenticated devices
Unauthorized configuration changes to building management parameters
HTTP access logs showing requests to U.htm endpoint from unknown sources
Legitimate administrator lockout events reported by building management personnel

Detection Strategies

Monitor network traffic for unauthenticated HTTP requests to Honeywell IQ4x web interfaces
Implement network segmentation monitoring to detect unauthorized access to OT/ICS networks
Deploy intrusion detection signatures for requests targeting the U.htm endpoint
Audit all Honeywell IQ4x devices for unexpected user account creation

Monitoring Recommendations

Enable comprehensive logging on all building management controllers and forward to a SIEM
Implement network traffic analysis for HTTP communications with ICS/OT devices
Establish baseline configurations for all Honeywell IQ4x controllers and alert on deviations
Configure alerts for authentication state changes on building management systems

How to Mitigate CVE-2026-3611

Immediate Actions Required

Immediately create administrative user accounts on all Honeywell IQ4x controllers to enable authentication
Isolate building management controllers from untrusted networks and the internet
Implement network segmentation between IT and OT environments
Audit all Honeywell IQ4x devices for unauthorized user accounts or configuration changes
Contact Honeywell support for guidance on securing affected deployments

Patch Information

Refer to the CISA ICS Advisory ICSA-26-069-03 for official remediation guidance. Additional technical details are available in the GitHub CSAF Resource. Organizations should also contact Honeywell directly for vendor-specific patch information and support.

Workarounds

Ensure all Honeywell IQ4x controllers have administrative user accounts configured immediately upon deployment
Implement strict network access controls limiting connectivity to building management devices
Deploy a VPN or jump host for administrative access to OT/ICS networks
Enable firewall rules blocking HTTP access to building management controllers from untrusted sources
Consider deploying a web application firewall (WAF) in front of exposed building management interfaces

bash

# Network segmentation example using iptables
# Block external access to building management controller HTTP interface
iptables -A INPUT -p tcp --dport 80 -s ! 10.0.100.0/24 -d 10.0.50.10 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 10.0.100.0/24 -d 10.0.50.10 -j DROP

# Allow only authorized management VLAN access
iptables -A INPUT -p tcp --dport 80 -s 10.0.100.0/24 -d 10.0.50.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -d 10.0.50.10 -j ACCEPT