CVE-2024-29844

Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions

State: Published
Severity: 9.8 Critical
Published: Apr 14, 2024
Updated: Sep 25, 2024
Reserved: Mar 21, 2024

Read the record on cve.org

Description

Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	directcyber

Weaknesses

CWE-1392 Use of Default Credentials

Affected Products

Product	Versions
Evolution ControllerCS Technologies Australia	2.xAffected

References

https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.