CVE-2026-3611: Honeywell IQ4 Series BMS Controller Auth Bypass

CVE-2026-3611 is a missing-authentication vulnerability in Honeywell's IQ4 Series building management controllers: the full web-based HMI is reachable without any login in the factory-default configuration, letting a remote, unauthenticated attacker operate under a System Guest (level 100) context and create administrative accounts with read/write privileges, which can lock out legitimate operators and give full control of building management functions.

CVE-2026-3611 is a missing-authentication-for-critical-function vulnerability (CWE-306) affecting Honeywell's IQ4 Series building management system (BMS) controllers — the IQ4E, IQ412, IQ422, IQ4NC and IQ41x models. NVD's description states: "The Honeywell IQ4x building management controller[] exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privilege[s]" to any attacker who can reach the HTTP interface (NVD).

NVD's own analysis assigns a Primary CVSS v3.1 score of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, scope change, with full compromise of confidentiality, integrity and availability. CISA's own ADP-submitted CVSS v4.0 and v3.1 scores agree at 10.0 (NVD).

CISA's ICS advisory ICSA-26-069-03 (Update A), covering critical manufacturing and commercial-facilities sectors, states that an attacker reaching the exposed HMI can create new administrative accounts with full read/write permissions, which can be used to lock out legitimate users from the controller. The researcher credited with reporting the issue is Gjoko Krstic of Zero Science Lab. Honeywell's mitigation is to upgrade affected controllers to firmware version 3.30 or later, but the advisory stresses that upgrading alone is not sufficient: authentication is disabled by design unless a user module is explicitly configured during commissioning, so Honeywell recommends verifying a user module is installed and configured even on devices already running 3.30 or later (CISA ICS Advisory ICSA-26-069-03).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-30 — confirmed by matching the exact cveID string against the raw KEV feed rather than relying on a summarized check. FIRST scores the probability of exploitation at 0.05721 (93.025th percentile) as of 2026-10-30, moderate for an OT device but notable given the trivial, fully unauthenticated attack path (CISA KEV, FIRST EPSS).

Building operators running IQ4 Series controllers should upgrade to firmware 3.30 or later and, critically, explicitly configure a user module and verify authentication is enforced — upgrading the firmware alone does not close this exposure on a controller with no user module installed. Controllers should also not be directly reachable from the internet or untrusted network segments.

• Honeywell IQ4 Series (IQ4E, IQ412, IQ422, IQ4NC, IQ41x) controllers expose the full web HMI without authentication by default, operating under a System Guest (level 100) context that grants read/write privileges to any reachable attacker. — NVD
• NVD Primary CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. — NVD
• An attacker can create new administrative accounts with full read/write permissions via the exposed HMI, which can lock out legitimate users; reported by Gjoko Krstic of Zero Science Lab; fixed in firmware 3.30, but a user module must still be explicitly configured to enforce authentication even on 3.30+. — CISA ICS Advisory ICSA-26-069-03
• Not present in the CISA KEV catalog as of 2026-10-30, confirmed against the raw feed's exact cveID strings. — CISA KEV
• EPSS score is 0.05721 (93.025th percentile) as of 2026-10-30. — FIRST EPSS