Skip to content
OpenAdvisories
Critical ICSA-26-069-03 1 CVE

Honeywell IQ4 Series BMS Controller (Update A)

Published Mar 10, 2026 · Updated Mar 26, 2026 · Revision 2

Vendor: Honeywell Product: IQ412 Firmware Product: IQ41x Firmware Product: IQ422 Firmware Product: IQ4E Firmware Product: IQ4NC Firmware

Summary

Successful exploitation of this vulnerability could allow an unauthorized attacker to access controller management settings, control components, disclose information, or cause a denial-of-service condition.

Vulnerabilities 1

  • Critical 10.0
    CVE-2026-3611 Public exploit

    Honeywell IQ4x BMS Controller Missing authentication for critical function

    The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 1…

    Honeywell IQ3 IQ4E IQ422 ICS / OT

Revision history

  1. #2

    Update A - Revised Affected Versions, updated vulnerability description and scores, and revised Mitigations to include the date of when secure default installations were enforced.

  2. #1

    Initial Publication

References