CVE-2026-3611: Honeywell IQ4x Auth Bypass Vulnerability

CVE-2026-3611 Overview

CVE-2026-3611 is a critical authentication bypass vulnerability affecting the Honeywell IQ4x building management controller. The device exposes its full web-based Human-Machine Interface (HMI) without authentication in its factory-default configuration. When no user module is configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface.

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). Authentication controls are only enforced after a web user is created via the U.htm endpoint, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote attacker can create a new account with administrative read/write permissions, enabling the user module and imposing authentication under attacker-controlled credentials.

Critical Impact

This vulnerability allows unauthenticated remote attackers to gain full administrative control over building management systems, potentially locking out legitimate operators from local and web-based configuration while enabling manipulation of critical building infrastructure.

Affected Products

• Honeywell IQ4x Building Management Controller (factory-default configuration)
• Honeywell IQ4x devices with no user module configured
• Honeywell IQ4x systems accessible via HTTP interface without authentication

Discovery Timeline

• 2026-03-12 - CVE-2026-3611 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3611

Vulnerability Analysis

This vulnerability represents a fundamental design flaw in the Honeywell IQ4x building management controller's authentication architecture. The device ships with security disabled by default, operating under a System Guest context with elevated privileges (level 100). This means any network-adjacent or internet-exposed device immediately grants read/write access to its entire configuration interface without requiring credentials.

The root of the issue lies in the conditional authentication model where the user module remains dormant until explicitly activated through the U.htm endpoint. This creates a critical window of exposure during initial deployment and affects any device that has been reset to factory defaults.

Root Cause

The vulnerability stems from an insecure default configuration (CWE-306: Missing Authentication for Critical Function). The Honeywell IQ4x controller was designed with a security model that assumes administrators will create user accounts immediately upon deployment. However, this assumption fails in practice as:

1. The device is fully functional without any authentication configured
2. The U.htm user creation endpoint is accessible to any party with network access
3. No warnings or forced authentication setup exists during initial deployment
4. The System Guest context provides excessive default privileges

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who can reach the HTTP interface of a vulnerable Honeywell IQ4x controller can exploit this vulnerability through the following attack pattern:

1. The attacker identifies an exposed Honeywell IQ4x controller on the network or internet
2. Without authentication, the attacker accesses the web-based HMI with full read/write privileges
3. The attacker navigates to the U.htm endpoint to create a new administrative account
4. Upon account creation, the user module is automatically enabled
5. The attacker's credentials become the controlling authentication mechanism
6. Legitimate operators are effectively locked out from local and web-based administration

This vulnerability is particularly dangerous in industrial control system (ICS) and operational technology (OT) environments where building management controllers may control HVAC, lighting, access control, and other critical building infrastructure.

Detection Methods for CVE-2026-3611

Indicators of Compromise

• Unexpected user accounts created on Honeywell IQ4x controllers
• Authentication suddenly enabled on previously unauthenticated devices
• Unauthorized configuration changes to building management parameters
• HTTP access logs showing requests to U.htm endpoint from unknown sources
• Legitimate administrator lockout events reported by building management personnel

Detection Strategies

• Monitor network traffic for unauthenticated HTTP requests to Honeywell IQ4x web interfaces
• Implement network segmentation monitoring to detect unauthorized access to OT/ICS networks
• Deploy intrusion detection signatures for requests targeting the U.htm endpoint
• Audit all Honeywell IQ4x devices for unexpected user account creation

Monitoring Recommendations

• Enable comprehensive logging on all building management controllers and forward to a SIEM
• Implement network traffic analysis for HTTP communications with ICS/OT devices
• Establish baseline configurations for all Honeywell IQ4x controllers and alert on deviations
• Configure alerts for authentication state changes on building management systems

How to Mitigate CVE-2026-3611

Immediate Actions Required

• Immediately create administrative user accounts on all Honeywell IQ4x controllers to enable authentication
• Isolate building management controllers from untrusted networks and the internet
• Implement network segmentation between IT and OT environments
• Audit all Honeywell IQ4x devices for unauthorized user accounts or configuration changes
• Contact Honeywell support for guidance on securing affected deployments

Patch Information

Refer to the CISA ICS Advisory ICSA-26-069-03 for official remediation guidance. Additional technical details are available in the GitHub CSAF Resource. Organizations should also contact Honeywell directly for vendor-specific patch information and support.

Workarounds

• Ensure all Honeywell IQ4x controllers have administrative user accounts configured immediately upon deployment
• Implement strict network access controls limiting connectivity to building management devices
• Deploy a VPN or jump host for administrative access to OT/ICS networks
• Enable firewall rules blocking HTTP access to building management controllers from untrusted sources
• Consider deploying a web application firewall (WAF) in front of exposed building management interfaces

# Network segmentation example using iptables
# Block external access to building management controller HTTP interface
iptables -A INPUT -p tcp --dport 80 -s ! 10.0.100.0/24 -d 10.0.50.10 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 10.0.100.0/24 -d 10.0.50.10 -j DROP

# Allow only authorized management VLAN access
iptables -A INPUT -p tcp --dport 80 -s 10.0.100.0/24 -d 10.0.50.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -d 10.0.50.10 -j ACCEPT