Honeywell
CVE-2026-3611
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to HTTP interface
-
DeliveryAccess U.htm endpoint unauthenticated
-
ExploitCreate administrative account
-
ExecutionModify building management system settings
-
ImpactDisable safety controls or extract sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Honeywell IQ4x controller in factory-default configuration with no user module configured. System Guest (level 100) context active, granting unauthenticated read/write access to HTTP HMI interface and U.htm account creation function. |
| Impact | CVSS 10.0. Building automation controller with no authentication. |
| Exploit ScenarioDerived | Full unauthenticated access to building management. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unauthenticated access to Honeywell IQ4x building controller HMI. CVSS 10.0.
Earlier versions of this analysis (1)
No auth on Honeywell building controller.
RemediationAI
Configure authentication.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-306 in factory default config.
Know when Honeywell gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
Executive ViewAI
Honeywell IQ4x building management controllers in their default configuration expose critical infrastructure control interfaces without any authentication, allowing unauthorized remote access to HVAC, lighting, and physical security systems. Any organization operating these devices faces immediate risk of facility disruption, safety incidents, and potential data exfiltration affecting business continuity.
Immediate mitigations pending vendor patch: (1) Implement network segmentation—restrict IQ4x device access via firewall to authorized administrative networks only; (2) Deploy reverse proxy/WAF with authentication enforcement in front of the HMI interface; (3) Change all factory-default credentials immediately; (4) Disable web-based HMI access if not operationally required, use local console only; (5) Enable network-based intrusion detection/prevention on IQ4x traffic; (6) Implement VPN/jump-host requirement for any remote access to these devices; (7) Monitor for suspicious access patterns to IQ4x management interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R
Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injec
Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest
Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x befo
Multiple stack-based buffer overflows in (1) HWOPOSScale.ocx and (2) HWOPOSSCANNER.ocx in Honeywell OPOS Suite before 1.
A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execut
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-
Unauthenticated remote code execution in Honeywell PD45 Industrial Printer firmware F10.19.010040 lets any network-reach
Controller may be loaded with malicious firmware which could enable remote code execution. Rated critical severity (CVSS
Exploit-DB