TI-2024-19618 Aliases CVE-2024-29843 GHSA-2rfp-5w3v-6w75

Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration

LOW 39CWE-200Published 2024-04-14 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.

Summary

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00498 42nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
CS Technologies Australia	Evolution Controller	2.x and later	—	No fix listed	CNA

Evolution Controller VendorCS Technologies Australia Affected 2.x and later Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cs-technologies:evolution::::::::	up to 2.04.560	Vulnerable	CS Technologies Australia

cpe:2.3:a:cs-technologies:evolution:*:*:*:*:*:*:*:* Versions up to 2.04.560 Vulnerable ·CS Technologies Australia

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-29843
2026-10-03 Alias added: GHSA-2rfp-5w3v-6w75

References

Advisory 1

https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html

TI-2024-19619 Default credentials on web interface of Evolution Controller Versions allows attackers to… CVSS 3.1CRITICAL 9.8
TI-2024-19611 Broken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeover CVSS 3.1CRITICAL 9.8
TI-2024-19612 Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections CVSS 3.1HIGH 8.8
TI-2024-19613 Unsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crash CVSS 3.1HIGH 7.5
TI-2024-19617 Information disclosure in CS Technologies Australia Evolution Controller CVSS 3.1HIGH 7.5
TI-2024-19616 Information disclosure in CS Technologies Australia Evolution Controller CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences