Vulnerability · Published Apr 14, 2024 · Assigned by directcyber
CVE-2024-29844Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions
Critical 9.8
In plain English
A critical-severity security flaw in Evolution Controller from CS Technologies Australia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 49.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CS Technologies Australia | Evolution Controller | 2.x |
Weakness: CWE-1392 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H