Honeywell IQ MultiAccess CVE-2026-13742

Q: What is the CVSS score of CVE-2026-13742?

CVE-2026-13742 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-40126 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-06-29 Honeywell

GHSA-93h9-2372-g58v

Information Disclosure Honeywell Iq Multiaccess

5.9

CVSS 4.0 · Vendor: Honeywell

Severity by source

Vendor (Honeywell) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Local vector and TOCTOU timing requirement justify AV:L and AC:H; low-privilege local account needed to write to staging path drives PR:L; high integrity and availability reflect full file-replacement impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Honeywell).

CVSS VectorVendor: Honeywell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 16:31 vuln.today

DescriptionCVE.org

Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verification vulnerability. An attacker could potentially exploit this vulnerability, leading to the replacement of downloaded file with a malicious one. Honeywell also recommends updating to the most recent version of this product, service, or offering [V27 SP1, V28 SP1]

AnalysisAI

Honeywell IQ MultiAccess physical access control software, all versions through V28, improperly verifies digital signatures on downloaded files due to a time-of-check/time-of-use (TOCTOU) race condition, allowing a local low-privileged attacker to replace a legitimately verified file with a malicious one in the window between signature check and file consumption. Successful exploitation yields high integrity and availability impact on the vulnerable system, as the replaced file may execute attacker-controlled code or corrupt system components. No public exploit identified at time of analysis; Honeywell has released patches V27 SP1 and V28 SP1.

Technical ContextAI

The root cause is CWE-367 (Time-of-Check Time-of-Use Race Condition): the software checks a downloaded file's digital signature and then - in a separate, non-atomic step - uses or installs that file. An attacker with local file-system write access to the staging path can race the process, substituting the legitimate file with a malicious payload after the signature passes validation but before the file is consumed. The affected product (CPE: cpe:2.3:a:honeywell_technologies:iq_multiaccess:*:*:*:*:*:*:*:*) is Honeywell's IQ MultiAccess, an enterprise physical access control management platform. The CVSS 4.0 vector encodes the attack prerequisites as AT:P, reflecting the non-trivial timing requirement inherent to TOCTOU exploitation.

RemediationAI

Upgrade to V27 SP1 or V28 SP1, as confirmed by Honeywell in their product security advisory at https://www.honeywell.com/us/en/product-security. These are the only versions that remediate the improper signature verification logic. As a compensating control pending patch deployment, restrict local interactive and network-share access to the IQ MultiAccess host so that only trusted administrators can write to file-staging directories used during software download operations; this reduces the attacker's ability to perform the file-swap in the race window, though it does not eliminate the underlying flaw. Enforcing least-privilege principles - removing unnecessary local user accounts and auditing write permissions on update staging paths - also limits exploitation opportunity.