CVE-2026-3611 is a missing authentication flaw in the Honeywell IQ4 series of building management controllers, scored 10.0 in the CVE record. In a factory default setup the web interface needs no login. Honeywell says firmware 3.30 and later force a user module at commissioning.
What's affected
- Product: Honeywell IQ4 series BMS controllers, models IQ4E, IQ412, IQ422, IQ4NC and IQ41x
- Affected versions: firmware before 3.30, per the CISA advisory
- Fixed version: 3.30 and later, with a condition described below
- Advisory: CISA ICSA-26-069-03, Update A, last revised 26 March 2026
The CVE record scores this 10.0. The CISA advisory lists a CVSS v3 score of 9.8 for the same flaw. Either way it is Critical. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and the advisory text reviewed here does not say it is exploited.
The CISA summary says successful exploitation could let an unauthorized attacker access controller management settings, control components, disclose information or cause a denial of service. It also says an attacker who creates an administrative account could lock legitimate users out of the controller.
How to check if you're exposed
There is no package to scan here, so the check is an inventory and configuration review.
- List every IQ4 series controller on your sites, with its model and firmware version.
- Mark any device with firmware older than 3.30.
- For every device, including those on 3.30 or later, confirm that a user module is set up so the web interface enforces authentication. The CISA advisory says devices updated from older firmware are not forced to install a user module unless the configuration files were changed after the update.
- Confirm which networks can reach the controllers' web interface, and whether any are reachable from the internet or from general office networks.
Firmware versions and the user module state are viewable from the controller's own tools and from your commissioning records. The vendor documentation and your installer can help if you do not have these on hand.
What to do now
- Identify all IQ4 controllers and their firmware versions.
- Update firmware to the latest version available from your dealer or the Trend Partner Network, which the advisory names as the source.
- Set up a user module on every controller, even those already on 3.30 or later, so authentication is enforced.
- Take the controllers off the internet and isolate the building automation network from the IT network, as the advisory recommends.
- Disable unneeded accounts and services, and limit access to authorized staff with least privilege.
- Log and monitor network traffic to the controllers for suspicious activity.
- Follow the Security Best Practice guide for Trend products that ships with the product documentation.
Why it matters
The record files this under CWE-306, missing authentication for a critical function. The record explains that with no user module configured, security is disabled by design and the system runs as a System Guest with read and write privileges for anyone who can reach the HTTP interface. Authentication switches on only after a web user is created, and that creation step is itself reachable before authentication.
That last point is the hard part. The very action that turns security on can be taken by an outsider, who then owns the credentials. The fix is not only a patch. It is making sure the controller was set up with authentication, and keeping the device off networks it does not belong on.
Building controllers run heating, cooling and access related systems for commercial buildings, hospitals and government sites, so a lockout or loss of control has physical consequences. Treat inventory and segmentation as the main controls.
Quick check
Is firmware 3.30 or later always safe?
Not automatically. Honeywell advises checking that a user module has been set up even on 3.30 or later, since devices updated from older firmware are not forced to install one.
What is the single most useful step?
Keep the controllers off the internet and isolated from general networks, then confirm each one has a user module with authentication enabled.
Which score is right, 10.0 or 9.8?
The CVE record says 10.0 and the CISA advisory lists 9.8. Both are Critical, so the response is the same.
Sources
Last reviewed: 19 October 2026.
