CVE-2024-29836

The Evolution Controller web application does not require authentication to perform operations on user profiles. Incorrect configuration of the access control mechanism (CWE-284) allows an unauthenticated attacker to send requests to user management endpoints. As a result, an attacker can create new accounts or modify existing profiles, and then log in with full privileges.

An attacker without any authentication can gain full access to the Evolution Controller application, including user management and all system functions. This results in a complete breach of confidentiality, integrity, and availability of the application.

Patches available from the manufacturer should be applied according to the references. It is also recommended to restrict access to the Evolution Controller web interface only to trusted networks or IP addresses at the firewall level until the update is deployed.

Cs-Technologies Evolution Controller in version 2.04.560.31.03.2024 and earlier.