Honeywell IQ MultiAccess implements signature checks on downloaded content, but versions prior to and including 28 fail to verify the digital signature before launching the file. The flaw allows an attacker to replace the originally intended content with a malicious artifact, potentially turning any subsequent execution into arbitrary code on the device. The impact therefore entails unauthorized code execution on systems using the affected firmware, exposing data integrity and availability to compromise.

The affected product is Honeywell IQ MultiAccess. All releases up to and including Version 28, including V27 SP1 and V28 SP1, are vulnerable. Devices running those firmware images are at risk of having their downloads replaced with malicious content.

The vulnerability has a CVSS score of 5.9, placing it in the medium severity range. No EPSS score is provided, and it is not listed in the CISA KEV catalog, indicating no confirmed exploitation in the field. The likely attack vector involves exploitation of the download or update mechanism, where a malicious source provides a payload that bypasses signature verification. Thus, while the formal exploitation likelihood appears low, a compromised download channel could still be used to inject malicious files, warranting precautionary measures.