Secuno
ENNL
Book demo

CVE-2026-3611

Honeywell Iq412 Firmware authentication bypass

10.0 CRITICALEPSS 0.99%
  1. Published12 Mar 2026

Description

The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Honeywell Iq412 Firmware< 3.30
Honeywell Iq41x Firmware< 3.30
Honeywell Iq422 Firmware< 3.30
Honeywell Iq4e Firmware< 3.30
Honeywell Iq4nc Firmware< 3.30

Remediation

Fixed in
Honeywell Iq412 Firmware≥ 3.30
Honeywell Iq41x Firmware≥ 3.30
Honeywell Iq422 Firmware≥ 3.30
Honeywell Iq4e Firmware≥ 3.30
Honeywell Iq4nc Firmware≥ 3.30

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-876899.8
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store…
CVE-2026-843138.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST…
CVE-2026-1095759.8
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition…
CVE-2026-571189.8
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59,…
CVE-2026-1093718.2
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the…
CVE-2026-1085498.1
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX…

Frequently asked

Is CVE-2026-3611 being actively exploited?

CVE-2026-3611 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.99%.

How severe is CVE-2026-3611?

CVE-2026-3611 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 0.99% probability of exploitation.

Which products are affected by CVE-2026-3611?

Affected products include Honeywell Iq412 Firmware, Honeywell Iq41x Firmware, Honeywell Iq422 Firmware, Honeywell Iq4e Firmware, Honeywell Iq4nc Firmware.

How do I fix CVE-2026-3611?

Upgrade affected software to a fixed version, for example Honeywell Iq412 Firmware 3.30, Honeywell Iq41x Firmware 3.30, Honeywell Iq422 Firmware 3.30 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-3611 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.