CVE-2024-29840 - Vulnerability Details - OpenCVE

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cs-technologies	Evolution

Configuration 1 [-]

cpe:2.3:a:cs-technologies:evolution:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html

History

Wed, 10 Dec 2025 17:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cs-technologies Cs-technologies evolution
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:a:cs-technologies:evolution::::::::
Vendors & Products		Cs-technologies Cs-technologies evolution

MITRE

Status: PUBLISHED

Assigner: directcyber

Published: 2024-04-14T23:48:05.450Z

Updated: 2024-08-02T01:17:58.069Z

Reserved: 2024-03-21T00:52:45.515Z

Link: CVE-2024-29840

Vulnrichment

Updated: 2024-08-02T01:17:58.069Z

NVD

Status : Analyzed

Published: 2024-04-15T00:15:13.753

Modified: 2025-12-10T17:38:15.083

Link: CVE-2024-29840

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29840", "assignerOrgId": "430a6cef-dc26-47e3-9fa8-52fb7f19644e", "state": "PUBLISHED", "assignerShortName": "directcyber", "dateReserved": "2024-03-21T00:52:45.515Z", "datePublished": "2024-04-14T23:48:05.450Z", "dateUpdated": "2024-08-02T01:17:58.069Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Evolution Controller", "vendor": "CS Technologies Australia", "versions": [{"status": "affected", "version": "2.x"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user<br><br>"}], "value": "The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user\n\n"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "430a6cef-dc26-47e3-9fa8-52fb7f19644e", "shortName": "directcyber", "dateUpdated": "2024-04-14T23:48:05.450Z"}, "references": [{"url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Broken Access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field values", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "cs_technologies", "product": "evolution_controller", "cpes": ["cpe:2.3:a:cs_technologies:evolution_controller:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.04.560.31.03.2024", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-22T17:32:57.011431Z", "id": "CVE-2024-29840", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T15:47:59.984Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:58.069Z"}, "title": "CVE Program Container", "references": [{"url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:58.069Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29840", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-22T17:32:57.011431Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:cs_technologies:evolution_controller:*:*:*:*:*:*:*:*"], "vendor": "cs_technologies", "product": "evolution_controller", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.04.560.31.03.2024"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-22T17:32:45.882Z"}}], "cna": {"title": "Broken Access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field values", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CS Technologies Australia", "product": "Evolution Controller", "versions": [{"status": "affected", "version": "2.x"}], "defaultStatus": "affected"}], "references": [{"url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user\n\n", "supportingMedia": [{"type": "text/html", "value": "The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "430a6cef-dc26-47e3-9fa8-52fb7f19644e", "shortName": "directcyber", "dateUpdated": "2024-04-14T23:48:05.450Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29840", "state": "PUBLISHED", "dateUpdated": "2024-08-02T01:17:58.069Z", "dateReserved": "2024-03-21T00:52:45.515Z", "assignerOrgId": "430a6cef-dc26-47e3-9fa8-52fb7f19644e", "datePublished": "2024-04-14T23:48:05.450Z", "assignerShortName": "directcyber"}, "dataVersion": "5.1"}