CVE-2026-3611

{"id": "CVE-2026-3611", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-12T21:16:27.693", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-03.json", "tags": ["Issue Tracking"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-03", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.honeywell.com/us/en/contact", "tags": ["Product"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration."}, {"lang": "es", "value": "El controlador de gesti\u00f3n de edificios Honeywell IQ4x expone su HMI completo basado en web sin autenticaci\u00f3n en su configuraci\u00f3n predeterminada de f\u00e1brica. Al no tener ning\u00fan m\u00f3dulo de usuario configurado, la seguridad est\u00e1 deshabilitada por dise\u00f1o y el sistema opera bajo un contexto de Invitado del Sistema (nivel 100), otorgando privilegios de lectura/escritura a cualquier parte capaz de alcanzar la interfaz HTTP. Los controles de autenticaci\u00f3n solo se aplican despu\u00e9s de que se crea un usuario web a trav\u00e9s de U.htm, lo que habilita din\u00e1micamente el m\u00f3dulo de usuario. Debido a que esta funci\u00f3n es accesible antes de la autenticaci\u00f3n, un usuario remoto puede crear una nueva cuenta con permisos administrativos de lectura/escritura, habilitando el m\u00f3dulo de usuario e imponiendo la autenticaci\u00f3n bajo credenciales controladas por el atacante. Esta acci\u00f3n puede bloquear eficazmente a los operadores leg\u00edtimos de la configuraci\u00f3n y administraci\u00f3n local y basada en web."}], "lastModified": "2026-06-05T19:39:29.520", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:iq4e_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64D4FED0-F7BD-48AC-AC59-06075C86EAB9", "versionEndExcluding": "3.30"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:iq4e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1CD48C55-F8BB-45B8-9D48-14CC945D9F58"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:iq412_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D9E71C6-E460-4F2F-81C1-48BD2FD6CA2C", "versionEndExcluding": "3.30"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:iq412:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AA5FC8F1-94F0-4848-881B-A1E6B89F790F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:iq422_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4742F1A-D5D9-48FB-AEB7-5422F7FF066E", "versionEndExcluding": "3.30"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:iq422:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F4E33759-C75F-4802-B9C8-D5355BC9C5CA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:iq4nc_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B0096DB-D66E-4BD9-AE99-98FBBD5D73A1", "versionEndExcluding": "3.30"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:iq4nc:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3BC9FA2A-6FDE-49EE-A204-C24ECE7113AB"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:iq41x_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C8FF65E-9C63-4645-9224-97C23C782E32", "versionEndExcluding": "3.30"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:iq41x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "90EB7C01-E8E0-421A-85FD-EAE27E527C1A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}