Skip to main content

Honeywell IQ MultiAccess CVE-2026-13742

| EUVDEUVD-2026-40126 MEDIUM
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-06-29 Honeywell GHSA-93h9-2372-g58v
Honeywell Information Disclosure Iq Multiaccess
5.9
CVSS 4.0 · Vendor: Honeywell
Share

Severity by source

Vendor (Honeywell) PRIMARY
5.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Local vector and TOCTOU timing requirement justify AV:L and AC:H; low-privilege local account needed to write to staging path drives PR:L; high integrity and availability reflect full file-replacement impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Honeywell).

CVSS VectorVendor: Honeywell

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 29, 2026 - 16:31 vuln.today

DescriptionCVE.org

Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verification vulnerability. An attacker could potentially exploit this vulnerability, leading to the replacement of downloaded file with a malicious one. Honeywell also recommends updating to the most recent version of this product, service, or offering [V27 SP1, V28 SP1]

AnalysisAI

Honeywell IQ MultiAccess physical access control software, all versions through V28, improperly verifies digital signatures on downloaded files due to a time-of-check/time-of-use (TOCTOU) race condition, allowing a local low-privileged attacker to replace a legitimately verified file with a malicious one in the window between signature check and file consumption. Successful exploitation yields high integrity and availability impact on the vulnerable system, as the replaced file may execute attacker-controlled code or corrupt system components. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Gain local low-privilege access to IQ MultiAccess host
Delivery
Identify staging directory for downloaded files
Exploit
Wait for or trigger a software download event
Install
Monitor for signature verification completion
C2
Replace staged file with malicious payload
Execute
Application consumes unsigned malicious file
Impact
Attacker-controlled code executes
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires local system access with at least low-level privileges sufficient to write to the directory where IQ MultiAccess stages downloaded files during an update or file-download operation (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.9 (Medium) reflects a constrained but meaningful threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged local user on a system running unpatched IQ MultiAccess monitors the file system for a software download or update event initiated by the application. Once the target file appears in its staging path and the signature check completes, the attacker rapidly replaces it with a malicious binary before the application consumes it. …
Remediation Upgrade to V27 SP1 or V28 SP1, as confirmed by Honeywell in their product security advisory at https://www.honeywell.com/us/en/product-security. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Honeywell

View all
CVE-2013-0108 MEDIUM POC
6.8 Feb 24

An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R
CVE-2015-0984 CRITICAL POC
10.0 Mar 31

Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C
CVE-2023-3710 CRITICAL POC
9.8 Sep 12

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injec
CVE-2017-14263 HIGH
8.1 Sep 11

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest
CVE-2017-5671 HIGH POC
8.8 Mar 29

Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x befo
CVE-2014-8269 HIGH
7.5 Dec 13

Multiple stack-based buffer overflows in (1) HWOPOSScale.ocx and (2) HWOPOSSCANNER.ocx in Honeywell OPOS Suite before 1.
CVE-2025-2605 CRITICAL
9.9 May 02

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB
CVE-2026-3611 CRITICAL
10.0 Mar 12

Unauthenticated access to Honeywell IQ4x building controller HMI. CVSS 10.0.
CVE-2017-5140 CRITICAL
9.8 Feb 13

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-
CVE-2017-5139 CRITICAL
9.8 Feb 13

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-
CVE-2023-25178 CRITICAL
9.8 Jul 13

Controller may be loaded with malicious firmware which could enable remote code execution. Rated critical severity (CVSS
CVE-2022-30318 CRITICAL
9.8 Aug 31

Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. Rated critical severity (CVSS 9.8), this vulnerability

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8
CVE-2026-25641 CRITICAL POC
10.0
CVE-2024-28718 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-13742 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy