CVE-2024-29843: fallo de gravedad alta en CS Technologies Australia Evolution Controller
Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.5%
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
CS Technologies Australia · Evolution ControllerCVEs relacionadas — CS Technologies Australia Evolution Controller
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-29844CRITICALDefault credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functionsEPSS 0.6%CVE-2024-29836CRITICALBroken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeoverEPSS 0.6%CVE-2024-29838HIGHUnsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashEPSS 0.5%CVE-2024-29837HIGHPoor session management in Evolution Controller allows administrator functionality for unauthenticated connectionsEPSS 0.5%CVE-2024-29842HIGHBroken Access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values EPSS 0.5%CVE-2024-29841HIGHBroken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values EPSS 0.5%