CVE-2024-29837: high-severity vulnerability in CS Technologies Australia Evolution Controller
Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.5%
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
CS Technologies Australia · Evolution ControllerRelated CVEs — CS Technologies Australia Evolution Controller
In the same product, most dangerous first.
CVE-2024-29844CRITICALDefault credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functionsEPSS 0.6%CVE-2024-29836CRITICALBroken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeoverEPSS 0.6%CVE-2024-29838HIGHUnsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashEPSS 0.5%CVE-2024-29843HIGHBroken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumerationEPSS 0.5%CVE-2024-29842HIGHBroken Access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values EPSS 0.5%CVE-2024-29841HIGHBroken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values EPSS 0.5%