CVE-2026-3611
Published: 12 March 2026
Summary
CVE-2026-3611 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Honeywell Iq4E Firmware. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).
Deeper analysis
CVE-2026-3611 affects the Honeywell IQ4x building management controller, where the full web-based human-machine interface (HMI) is exposed without authentication in its factory-default configuration. Without a user module configured, security is disabled by design, allowing the system to operate under a System Guest (level 100) context that grants read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via the U.htm page, which remains accessible prior to any authentication setup.
A remote attacker with network access to the HTTP interface can exploit this vulnerability without authentication or privileges. By accessing U.htm, the attacker can create a new account with administrative read/write permissions, dynamically enabling the user module under attacker-controlled credentials. This grants the attacker full control over the controller's configuration and administration, potentially locking out legitimate operators from both local and web-based access.
CISA's ICS Advisory ICSA-26-069-03 details mitigation recommendations for this vulnerability, available at the provided references including the CSAF JSON file and CISA news event page. Honeywell contact information is also listed for further support.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11706
Vulnerability details
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write…
more
privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated access to public-facing web HMI enables exploitation (T1190) and creation of local administrative accounts (T1136.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly identifies and limits actions permitted without identification or authentication, preventing unauthenticated access to the HMI and U.htm for user creation and configuration changes.
Requires unique identification and authentication for organizational users, enforcing authentication on the web HMI to block unauthenticated read/write privileges and account creation.
Mandates secure account management processes including approval for creation and privilege assignment, preventing attackers from creating administrative accounts via the accessible U.htm page.