CVE-2024-29844

The application does not require users to change the default password during installation or on first launch. No warning or prompt is displayed to change the default credentials. As a result, anyone knowing the factory login credentials can log in directly to the web interface and perform administrative functions without any additional authentication barriers.

An attacker gains full administrative access to the Evolution Controller system, enabling them to read and modify configuration, and potentially compromise the confidentiality, integrity, and availability of the controlled environment.

Immediately change the default administrative password to a strong, unique password and apply patches available from the manufacturer according to the references. It is also recommended to restrict access to the web interface only to trusted IP addresses using a firewall and to monitor unauthorized login attempts.

Cs-Technologies Evolution Controller version 2.x with default web interface configuration