CVE-2024-29844
📋 TL;DR
CVE-2024-29844 is a critical authentication bypass vulnerability in Evolution Controller 2.x web interface that allows attackers to log in using default credentials. This affects all Evolution Controller 2.x installations where administrators haven't manually changed the default password. Attackers gain full administrative access to the controller system.
💻 Affected Systems
- Evolution Controller
📦 What is this software?
Evolution by Cs Technologies
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to reconfigure the controller, disable security controls, access sensitive data, and potentially pivot to other systems in the network.
Likely Case
Unauthorized administrative access leading to configuration changes, data theft, and potential disruption of controlled systems.
If Mitigated
No impact if default credentials were changed during initial setup or if network access controls prevent external access.
🎯 Exploit Status
Exploitation requires only knowledge of default credentials and network access to the web interface. No technical skills needed beyond basic web navigation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Log into Evolution Controller web interface
2. Navigate to administration/user settings
3. Change default password to a strong, unique password
4. Ensure all administrative accounts have strong passwords
🔧 Temporary Workarounds
Network Access Control
allRestrict network access to Evolution Controller web interface using firewall rules
IP Whitelisting
allConfigure web interface to only accept connections from trusted IP addresses
🧯 If You Can't Patch
- Immediately change all default passwords to strong, unique credentials
- Implement network segmentation to isolate Evolution Controller from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Attempt to log into Evolution Controller web interface using default credentials (check vendor documentation for specific defaults)Check Version:
Check version in web interface administration panel or system information pageVerify Fix Applied:
Verify that default credentials no longer work and strong passwords are required for all accounts📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login with default credentials
- Administrative actions from unexpected IP addresses
Network Indicators:
- HTTP requests to administrative endpoints from unauthorized sources
- Traffic patterns indicating configuration changes
SIEM Query:
source="evolution-controller" AND (event_type="login" AND result="success" AND user="admin") OR (event_type="configuration_change" AND source_ip NOT IN [trusted_ips])