CVE-2024-0242 is a high severity (CVSS 7.3) flaw in Qolsys IQ Panel 4 and IQ4 Hub software, which can allow unauthorized access to settings under certain circumstances. Versions before 4.4.2 are affected, so update the panel software to 4.4.2.
What's affected
The CISA advisory lists IQ Panel 4 and IQ4 Hub, both on software before 4.4.2, and gives 4.4.2 as the fixed version. The description is short: under certain circumstances the panel software could allow unauthorized access to settings.
CISA states the issue is not exploitable remotely and that it had no reports of known public exploitation. That fits the CVSS vector in the record, which has a physical attack vector (AV:P). The record's score is 7.3 and the CISA score is the same, so there is no disagreement on severity. The vendor, Johnson Controls, publishes its own advisory (JCI-PSA-2024-03), which we did not fetch.
How to check if you're exposed
The panel's software version is shown in its settings screens, and installers or dealers can usually see it through their management tools. For a fleet of panels, ask your alarm dealer or installer for a version report. If you manage them yourself, check each panel's about screen and write down the version.
Because the vector is physical, the places that matter are panels installed where strangers can get hands on them: shops, shared lobbies, rental properties and offices with public access. A panel in a locked utility room is a different risk from one beside a customer entrance.
Also check how the panels are connected. CISA's general advice for control system devices applies: keep them off the internet, behind firewalls, and separate from business networks.
What to do now
- Get the software version of every IQ Panel 4 and IQ4 Hub you operate.
- Update panels below 4.4.2. The firmware can be pushed remotely to devices in the field, per CISA, or applied manually with the patch tag iqpanel4.4.2.
- Read Johnson Controls advisory JCI-PSA-2024-03 for detailed instructions.
- Review who has physical access to panels and move or protect any that are publicly reachable.
- Keep panels off the internet and away from business networks, using VPNs for remote access when needed.
Why it matters
The weakness class is CWE-200, exposure of sensitive information to an unauthorized actor. The advisory describes it as access to settings, and does not spell out which settings. We will not guess. Settings on a security panel can include things like codes and device configuration, but the advisory does not say that, so treat the effect as unauthorized access to configuration.
The CVSS vector is physical, low complexity and needs no privileges, with changed scope and high integrity and availability impact. In plain terms, someone standing at the panel could reach settings they should not, and on an alarm system the integrity of those settings is the point of the product.
The record's KEV flag is false, and CISA's advisory says it had no known public exploitation reports. This is a patch-in-cycle item, with first priority on panels in publicly accessible places.
Quick check
Can this be exploited over the internet?
CISA says it is not exploitable remotely. The record's vector is physical.
What is the fixed version?
4.4.2, according to the CISA advisory.
Sources
Last reviewed: 19 October 2026.
