CVE-2024-29844
Published: 15 April 2024
Summary
CVE-2024-29844 is a critical-severity Use of Default Credentials (CWE-1392) vulnerability in Cs-Technologies Evolution. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 25.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-26836
Vulnerability details
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password.…
more
There is no warning or prompt to ask the user to change the default password.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates replacement of default credentials during secure configuration and provisioning procedures.
Policy requires changing or avoiding default credentials during system setup and operation.
Unique identification requirement prevents use of default or shared credentials by organizational users.
Changing default authenticators prior to first use prevents use of default credentials.
Standards-compliant authentication mechanisms typically prohibit default credentials for cryptographic modules.
Consistent implementation of the strategy drives removal or mitigation of default credentials in procured systems and services.
Security functional requirements and acceptance criteria can stipulate that acquired systems must not use default credentials.
Documentation of known configuration vulnerabilities and secure setup practices reduces reliance on default credentials.