Paper/Archive/CVE-2024-29844

CVE-2024-29844

CS Technologies Australia Evolution Controller — Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 50.0.500 × 2010.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password.

Affected

ProductAffectedFixed inSource

Evolution Controller2.x–CNA

evolution_controller≤ 2.04.560.31.03.2024–CISA-ADP

Scores by source

directcyber (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdirectcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html