Authentication Bypass Vulnerability in Honeywell IQ4x Building Management Controller

CVE-2026-3611

What is CVE-2026-3611?

The Honeywell IQ4x building management controller presents a significant security concern as it exposes its entire web-based human-machine interface (HMI) without authentication in its factory-default configuration. By default, the system operates under a System Guest context, allowing unrestricted read/write access to the HTTP interface. A remote attacker can exploit this vulnerability to create a new account with administrative privileges before any authentication is enforced, effectively locking out legitimate users from local and web-based management functionalities. The inability to securely manage user access poses a serious risk to the integrity of building management systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References