Unlocked and Unwatched: Honeywell Building Controllers Leave Doors Wide Open to Hackers

It’s the kind of security blunder that keeps building managers up at night-except most have no idea it’s lurking inside their walls. This March, researchers revealed that Honeywell’s Trend IQ4xx series, a backbone of building automation worldwide, ships with its powerful web interface unlocked by default. The result? Anyone with network access can seize control, create new admin accounts, and even shut out legitimate operators-all before a single password is set.

The Anatomy of an Unlocked System

The IQ4xx controllers-responsible for heating, ventilation, lighting, and more-are essential in modern buildings. But a critical oversight means these devices, in their factory state, do not require any login. The web-based Human-Machine Interface (HMI) is wide open, granting full “System User” privileges (the highest level) to anyone who can reach it. That includes not just local technicians, but potentially any remote attacker who stumbles upon the device on a flat network or via misconfigured remote access.

Worse, the system’s user creation page (U.htm) is accessible before any authentication is set up. A would-be attacker can simply visit this page, create a new admin account with their own credentials, and instantly lock out building operators-effectively taking over the entire system. A hidden diagnostics endpoint (/^.htm) further expands the attack surface, offering deeper system insights to unauthenticated users.

Vendors Respond, But Is It Enough?

Honeywell’s response has been to remind customers that the devices are meant for on-premise use only and should not be left exposed to the internet. But real-world deployments are rarely so neat: flat networks, VPNs, and remote management are common, and thousands of controllers have been found online. Security experts argue that “security by isolation” is no substitute for secure-by-default design-especially when a single overlooked setting can hand over the keys to the kingdom.

Despite repeated warnings from researchers at Zero Science Lab, Honeywell has yet to issue a patch or even assign a CVE to the flaw. Instead, the burden falls on customers to create a user account immediately upon setup, isolate devices with firewalls, and vigilantly monitor for signs of compromise. Proof-of-concept scripts are now circulating, making exploitation as easy as running a Python file.

The Bigger Picture

This incident is a stark reminder: in the world of industrial and building control systems, default settings can be a silent saboteur. As buildings become smarter, their weakest link isn’t always a hacker-it’s often a forgotten checkbox. Until vendors like Honeywell treat security as a foundation, not an afterthought, the doors will stay wide open.

WIKICROOK

• Human: A human is an individual interacting with digital systems, often providing oversight, validation, and decision-making in cybersecurity processes like HITL.
• Default Configuration: Default configuration is the preset setup of a system or device, often lacking strong security, and should be changed to protect against cyber threats.
• Privilege Level: Privilege level is the amount of access or control a user or process has on a system, affecting what actions they can perform.
• Proof: A Proof-of-Concept (PoC) is a demonstration showing that a cybersecurity vulnerability can be exploited, helping to validate and assess real risks.
• Flat Network: A flat network has little or no segmentation, allowing devices to communicate freely and making it easier for threats to spread across the network.