Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Honeywell says the IQ4 authentication flaw can arise only before a controller is properly set up or after security settings are deliberately disabled; researcher Gjoko Krstic says he has seen unfinished installations where an unauthenticated user could change building controls. SecurityWeek confirmed that many IQ4 interfaces were exposed to the internet, but did not verify Krstic’s reported equipment-control effects or his estimate of how many devices were vulnerable. The issue is tracked as CVE-2026-3611 and applies to several IQ4x product families in the CVE record’s stated version scope.
What the Honeywell IQ4 vulnerability is
The reported flaw concerns authentication on the IQ4 controller’s web-based human-machine interface (HMI). In a factory-default configuration, Krstic said, an actor able to reach the management interface could create an administrator account before legitimate users do if the controller is not properly configured and its user module is not enabled during setup. He said this could lock legitimate operators out of local and web-based administration. SecurityWeek reported his account on March 3, 2026.
This is a reported setup-related condition, not a confirmed finding that every deployed IQ4 controller is unauthenticated or vulnerable. The disagreement is about when the condition can occur and whether a controller in that state can affect building equipment.
How Honeywell and the researcher differ
| Question | Honeywell’s position | Krstic’s position and verification status |
|---|---|---|
| When can the condition occur? | Honeywell told SecurityWeek that IQ4 devices are delivered unconfigured and set up by trained technicians before operation. It said the described condition could occur during a brief installation phase before activation, or if security settings were deliberately disabled against warnings. | Krstic said he had encountered installations where no user account had been created. SecurityWeek did not independently verify how often such installations occur or whether they represent a broader deployed condition. |
| Can the controller affect physical systems before normal setup? | Honeywell said that during the described pre-operational stage, the device cannot monitor or control equipment and that a standard reset can resolve an installation issue. | Krstic said he could write changes to lighting and temperature components and turn off a boiler or chiller on installations without a user account. SecurityWeek did not verify these operational-impact claims. |
| Are interfaces exposed to the internet? | Honeywell’s statement framed the issue around configuration and setup. | SecurityWeek independently confirmed that many IQ4 interfaces were internet-exposed. It did not verify Krstic’s full count or his estimate of the unauthenticated share. |
| Is a fix available? | The accessible reporting and CVE record do not establish a current IQ4-specific fix status. | Operators should check the current Honeywell notice and CISA advisory rather than infer availability from the initial reporting. |
Honeywell’s statement to SecurityWeek said, “IQ4 devices are delivered unconfigured and are set up by trained technicians before they become operational,” and, “At that stage, the device cannot monitor or control any equipment, and there is no impact on operations.” Krstic told the publication: “I’ve seen installations where the user account has not been created and I was able to write changes to components like lighting and temperature, turn off the boiler or chiller, and other operations on control equipment.” These are opposing accounts; the reporting confirms internet exposure of many interfaces, not the researcher’s physical-control claims.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Qolsys IQPH052 Verizon IQ4 Hub 345 MHz, Whole Home Hub with 7" Touchscreen, Qolsys Inc, Qolsys
- Alert type: Motion
- Power source type: Corded Electric
What CVE-2026-3611 covers
The CVE-2026-3611 record, published March 12 and updated March 30, 2026, describes a missing-authentication issue in Honeywell IQ4x building-management controllers. It lists the following product families and affected configurations through version 4.36 (build 4.3.7.9):
- IQ4E
- IQ412
- IQ422
- IQ4NC
- IQ41x
- IQ3
- IQECO
That boundary reflects the CVE record’s stated scope; operators should verify the exact model and installed software against current manufacturer guidance before deciding whether a system is affected. The record references CISA advisory ICSA-26-069-03, dated March 10, 2026. The advisory’s contents are not independently established here, so consult it directly for current official guidance.
Rank #2
- Change Sensing Locations - Choose the "sense from here" option to sense temperature from a location other than the thermostat
- Control Multiple Zones - When installed with zoning, can be used to change the set temperature from any zone
- Zero Interference - Will not interfere with other wireless devices in the home, such as baby monitors or cordless phones
- Built-in Pager - Push a button on the thermostat to locate the control with an audible noise
- Goes the Distance - Works in every home - tested up to 10, 000 square feet
What the exposure numbers do—and do not—show
Krstic told SecurityWeek he found nearly 7,500 IQ4 instances exposed to the internet and estimated that around 20% could be accessed without authentication. Both figures are researcher-reported estimates, not independently established measurements. SecurityWeek confirmed that many interfaces were internet-exposed but did not verify the total, the unauthenticated percentage, or the reported ability to alter equipment. No independently sourced population count or prevalence figure was established in the reporting.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What facility operators should do
- Identify the installed equipment. Record the controller’s exact IQ4-family model and software version, then compare them with the current Honeywell security notice and CVE scope.
- Check current official guidance. Review Honeywell’s latest product-security information and CISA’s ICSA-26-069-03 advisory for any remediation or mitigation updates. The Honeywell Product Security page describes its general disclosure process; it does not establish an IQ4-specific fix.
- Have a qualified building-automation technician verify setup. Confirm that the controller has been commissioned using the manufacturer’s documented secure-installation procedure and that user authentication is enabled. Do not treat a device as safe merely because it is believed to be in an installation phase.
- Review network reachability. Determine whether the web HMI is reachable from the public internet or from networks that do not require access for operations. Restrict access in line with current Honeywell guidance and facility policy; do not assume that the exposure observed by SecurityWeek proves a particular site is affected.
- Escalate suspected unauthorized access or control changes. Follow the facility’s incident-response process and contact the responsible Honeywell service provider or qualified integrator. Do not rely on a reset as a security fix unless current manufacturer guidance directs that action.
At publication, the accessible CVE record and reporting do not establish whether a fix is currently available. Verify remediation status directly before making operational decisions; do not infer that the issue is patched or unpatched from the initial news coverage.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Best Value
- Country of Origin: CHINA
- The Package Length of the product is 6.2 inches
- The Package Width of the product is 8.2 inches
- The Package Height of the product is 13 inches
Rank #4
- HVAC Controls and Thermostats
- Manufacturer: Honeywell
- Country of Manufacturer: Mexico
Rank #3
- Dimensions: 4-1/16 W x 1-3/32 D x 4-1/16 H in.
- Hardwired - C-wire required
- Geofencing, 7-day, 5-2, 5-1-1, 1-week or non-programmable
- Integrates with smart home Apple HomeKit and Amazon Alexa for customers who want to control their smart home devices from a single app
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
