CVE-2026-3611

In the factory configuration, the user module is not activated, and the system operates in the context of a System Guest account (level 100) with read and write permissions for each HTTP client. Authentication control is only enabled after the first web user is created through the U.htm page, which dynamically activates the user module. Since the U.htm page is accessible before authentication, a remote attacker can create a new administrative account with read and write privileges without any credentials, thereby activating the authentication module under their controlled credentials. As a result, legitimate operators lose access to both local and web configuration of the device.

An attacker can remotely and without authentication gain full administrative privileges to the building controller, modify its configuration, and permanently block access to legitimate operators by taking over the authentication mechanism.

The web user account must be configured immediately through the U.htm page to activate the authentication module and enforce access control. The device should not be exposed to publicly accessible networks without prior authentication configuration. Patches available from the manufacturer should be applied according to references (ICSA-26-069-03) and CISA recommendations should be reviewed at https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-03

Honeywell IQ4x building management controller in factory configuration (without configured user module); specific versions indicated in manufacturer references (ICSA-26-069-03)