Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 10 products
| Date | Total | Labels |
|---|
| 2026-03-11 | 1 | Disclosure1 |
| 2026-03-12 | 4 | Disclosure4 |
| 2026-03-13 | 1 | Disclosure1 |
| 2026-03-15 | 1 | Disclosure1 |
| 2026-04-15 | 1 | Disclosure1 |
🚨 CVE-2026-3611 (CVSS: 10.0) ファクトリーデフォルト設定でWeb HMIが認証なしでアクセス可能。システムゲストコンテキストで読み書き権限あり。攻撃者は管理者アカウント作成可能で、正当な操作者を排除。初期設定変更、認証強制を推奨。 https://maruomosquit.com/vulnerability/CVE-2026-3611/ #脆弱性 #セキュリティ
Post summary
CVE‑2026‑3611 is a zero‑authentication flaw in factory‐default Web HMI settings that lets attackers create admin accounts and bypass legitimate users; remediation involves changing defaults and enabling authentication.
A critical 10.0 CVSS flaw (CVE-2026-3611) in Honeywell IQ4x BMS controllers leaves web HMIs exposed without authentication. Secure your systems immediately. #Honeywell #CVE20263611 #BMSSecurity #ICSSecurity #CyberSecurity #InfoSec #Vulnerability #IoT https://securityonline.info/the-default-danger-maximum-10-0-cvss-vulnerability-leaves-honeywell-iq4x-controllers-wide-open/ https://t.co/duj4t8RymX
Post summary
The tweet announces CVE-2026-3611, a 10.0 CVSS flaw that leaves Honeywell IQ4x BMS web HMIs exposed without authentication, urging immediate protection while offering no PoC, exploit code, or patch details.
🔒 #CyberSecurity Critical Honeywell IQ4x Vulnerability (CVE-2026-3611) Enables Full System Takeo… "Building Management Systems (BMS) are the silent heartbeat of modern facilities,…" 🔗 https://securityarsenal.com/blog/critical-honeywell-iq4x-vulnerability-cve-2026-3611-enables-full-system-takeover #CyberSecurity #ThreatIntel #healthcare #hipaa #ransomware
Post summary
The post announces the existence of CVE-2026-3611, a critical vulnerability affecting Honeywell IQ4x Building Management Systems, but it provides no details on PoC, exploit code, active use, patch, or technical specifics.
CVE-2026-3611 Unauthenticated Web Interface Takeover in Honeywell IQ4x Building Management Controller https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3611
Post summary
A brief announcement of CVE-2026-3611, an unauthenticated web interface takeover vulnerability affecting Honeywell IQ4x Building Management Controllers, with only a link to the vulnerability details.
CVE-2026-3611 The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module confi… https://www.cve.org/CVERecord?id=CVE-2026-3611
Post summary
Honeywell IQ4x building management controllers expose their full web‑based HMI without authentication when left in the factory‑default state, creating a critical unauthenticated access vulnerability.
[CVE-2026-3611: CRITICAL] Honeywell IQ4x controller lacks authentication, allowing remote users to create admin accounts, compromising system security. #cybersecurity #HoneywellIQ4x#cve,CVE-2026-3611,#cybersecurity https://cvefind.com/CVE-2026-3611
Post summary
The post discloses a critical authentication bypass (CVE‑2026‑3611) in Honeywell IQ4x controllers, allowing remote attackers to create admin accounts.
🔴 CVE-2026-3611 - Critical The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is d... https://www.thehackerwire.com/vulnerability/CVE-2026-3611/ https://t.co/C6fbFN4Ltz
Post summary
Honeywell IQ4x building management controllers expose their full web‑based HMI without authentication, revealing a critical configuration flaw; no PoC, exploit, or patch details are provided.
🚨 CVE-2026-3611: Honeywell IQ4x BMS Controller Mis... Factory-default Honeywell BMS controllers ship with auth disabled—attackers can remotely create admin accounts and lock ... https://zerodaysignal.com/vulnerability/CVE-2026-3611 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE‑2026‑3611, noting that Honeywell IQ4x BMS controllers ship with authentication disabled, enabling attackers to create admin accounts remotely, and provides a link for further details.
10 of 10 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | honeywell | iq412 | - | - | - |
| OS | honeywell | iq412_firmware | - | - | - |
| HW | honeywell | iq41x | - | - | - |
| OS | honeywell | iq41x_firmware | - | - | - |
| HW | honeywell | iq422 | - | - | - |
| OS | honeywell | iq422_firmware | - | - | - |
| HW | honeywell | iq4e | - | - | - |
| OS | honeywell | iq4e_firmware | - | - | - |
| HW | honeywell | iq4nc | - | - | - |
| OS | honeywell | iq4nc_firmware | - | - | - |