Loading story…
Honeywell IQ4x building management system (BMS) controllers were reported to expose their full web-based HMI without authentication in factory-default configurations, tracked as CVE-2026-3611. When no web user module is configured, the device operates under a System Guest (level 100) context that can provide read/write access to anyone who can reach the HTTP interface; authentication is only enforced after a user is created. Because the user-creation function (via U.htm) is reachable prior to authentication, a remote attacker can create an administrative account, enable the user module under attacker-controlled credentials, and potentially lock out legitimate operators, with impacts including unauthorized access to management settings, component control, information disclosure, and denial of service.
This is not fluff; it is a concrete ICS/OT vulnerability disclosure with clear exploitation conditions and operational impact. However, several other items in the set are separate CISA ICS advisories for different products and CVEs (Inductive Automation Ignition deserialization leading to code execution; Apeman camera issues enabling device takeover/viewing feeds; and multiple Lantronix EDS vulnerabilities including auth bypass and root-level command injection) and should be treated as distinct security stories rather than part of the Honeywell IQ4x event.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A high-severity public CVE entry reiterated technical details showing that IQ4x controllers in default configuration run the web interface as a privileged System Guest and permit pre-authentication creation of an admin account. This reference did not introduce a new incident but expanded public availability of the vulnerability details.
CISA issued advisory ICSA-26-069-03 for CVE-2026-3611, identifying affected IQ4x firmware versions from 3.50_3.44 up to but not including 4.36_build_4.3.7.9 and rating the issue CVSS 10.0. The advisory recommended standard ICS mitigations such as minimizing internet exposure, network segmentation, and secure remote access, and stated there was no known public exploitation at publication time.
A critical vulnerability affecting Honeywell IQ4x Building Management System controllers was disclosed, describing how factory-default configurations expose the full web HMI without authentication. The flaw allows remote attackers to create an administrative account via the pre-authenticated U.htm function, gain control of management settings, and potentially lock out legitimate operators.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA published multiple ICS advisories warning of high-severity vulnerabilities affecting industrial/IoT products deployed in critical infrastructure environments. For **Jinan USR IOT Technology (PUSR) USR-W610** (<= `3.1.1.0`), CISA reported multiple issues (including **CVE-2026-25715**, **CVE-2026-24455**, **CVE-2026-26049**, **CVE-2026-26048**) that could allow authentication to be effectively disabled (e.g., permitting blank admin credentials over the web interface and Telnet), enable credential exposure (including administrator credentials), and cause denial-of-service; one of the cited conditions results in full administrative control for a network-adjacent attacker without valid credentials (CVSS v3.1 **9.8**). Separately, **EnOcean SmartServer IoT** (<= `4.60.009`) was reported vulnerable to **OS command execution** via crafted LON IP-852 management messages (**CVE-2026-20761**) and an additional weakness that could leak memory and help bypass mitigations such as ASLR (**CVE-2026-22885**) (CVSS v3.1 **8.1**). CISA also warned that **Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller** is affected by **CVE-2026-24790** (**missing authentication for a critical function**), where the underlying PLC can be remotely influenced without proper safeguards, creating risk of **over- or under-odorization events** (CVSS v3.1 **8.2**). In parallel reporting, a separate CISA warning covered **Honeywell CCTV** products impacted by **CVE-2026-1670** (CVSS **9.8**), where an unauthenticated API endpoint could allow an attacker to change the “forgot password” recovery email and take over accounts to access camera feeds; at the time of reporting, there were no public exploitation reports, and CISA recommended reducing exposure (e.g., isolating devices behind firewalls and using secure remote access).
Jun 29, 2026
Industrial control system (ICS) vulnerability reporting hit record levels in 2025, with **508 ICS advisories** covering **2,155 CVEs** and an increasing average severity (CVSS averages exceeding **8.0** in 2024–2025), according to a Forescout report. The report highlights that **Purdue Level 1 devices** (e.g., PLCs/RTUs/IEDs) were most affected, followed by Level 3 operational systems and Level 2 control systems, with **critical manufacturing and energy** most impacted. It also flags a growing visibility gap as an increasing number of ICS vulnerabilities lack associated **CISA ICSA** publications, including changes in how some vendor advisories (e.g., Siemens) are routed. CISA published an ICS advisory for **Valmet DNA Engineering Web Tools** (<= `C2022`) describing **CVE-2025-15577**, a **high-severity path traversal** issue (CVSS 3.1 **8.6**) that could allow an **unauthenticated attacker** to manipulate a web maintenance services URL to achieve **arbitrary file read**. Separately, CISA also warned (as reported by BleepingComputer) of a **critical** authentication flaw in multiple **Honeywell CCTV** products, **CVE-2026-1670** (CVSS **9.8**), where an exposed unauthenticated API endpoint could let an attacker change the “forgot password” recovery email and potentially enable **account takeover** and **unauthorized camera feed access**; CISA reported no known public exploitation at the time and reiterated standard ICS/OT hardening guidance (reduce exposure, segment networks, and secure remote access).
Jun 29, 2026
**CISA** published an ICS advisory warning that **Johnson Controls Frick Controls Quantum HD** (versions **10.22 and earlier**) contains multiple vulnerabilities that can be exploited **before authentication**, enabling **remote code execution (RCE)**, **information leakage**, and potentially **denial of service** in environments where the product is deployed (noted as worldwide, including **Food and Agriculture** critical infrastructure). CISA lists a **CVSS v3.1 base score of 9.1 (Critical)** for the issue set and attributes the root cause across several items to **insufficient input validation** in device parameters. The disclosed CVEs include **CVE-2026-21654** (**OS command injection**, CWE-78) and several **code injection** RCE issues (**CVE-2026-21656**, **CVE-2026-21657**, **CVE-2026-21658**, **CWE-94**) that could allow unexpected actions and system compromise without credentials. **CVE-2026-21659** describes **local file inclusion (LFI)** (CWE-23) leading to **unauthenticated RCE and information disclosure**, explicitly stating an attacker could execute arbitrary code and achieve **full system compromise** on affected devices. The advisory also references an additional CVE (**CVE-2026-21660**) not detailed in the other provided entries, indicating the exposure spans more than the five CVE records included here.
Jun 29, 2026