CVE-2024-29837

HIGH

Evolution Controller <2.04.560.31.03.2024 - Info Disclosure

Title source: llm

Description

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.

References (1)

[Third Party Advisory] https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html

Scores

CVSS v3 8.8

EPSS 0.0020

EPSS Percentile 41.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-284 CWE-1390 CWE-287

Status published

Products (1)

cs-technologies/evolution < 2.04.560

Published Apr 15, 2024

Tracked Since Feb 18, 2026