The Honeywell IQ4x building‑management controller exposes its full web‑based HMI without authentication when the device is in its factory‑default configuration. Because the user module is disabled until a new account is created via the U.htm page, an unauthenticated remote user can establish a new administrative account with read/write privileges. This creates a privilege‑escalation path that can lock out legitimate operators and grant the attacker full configuration control, a flaw identified as CWE‑306 Missing Authentication for a Critical Function.

Affected products include Honeywell IQ3, IQ412, IQ41x, IQ422, IQ4E, IQ4NC, and IQECO. The vulnerability manifests when any of these controllers remain in the default state with no authentication enabled. No specific version ranges are quoted; thus any listed device in the default, unconfigured state is potentially vulnerable.

The CVSS score of 10 indicates critical severity, and the EPSS score of less than 1% suggests limited historical exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely over the unsecured HTTP interface without special privileges, create a privileged account, and then deny legitimate users access to the controller.