Paper/Archive/CVE-2024-29836

CVE-2024-29836

CS Technologies Australia Evolution Controller — Broken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeover

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 47.9.479 × 209.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site.

Affected

ProductAffectedFixed inSource

Evolution Controller2.x–CNA

evolution_controller≤ 2.04.560.31.03.2024–CISA-ADP

Scores by source

directcyber (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdirectcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html