PT-2024-23075 · Unknown · Evolution Controller

Adam Foster · Published 2024-04-14 · Updated 2025-12-10 · CVE-2024-29838

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Evolution Controller versions 2.04.560.31.03.2024 and below

Description The Web interface of the Evolution Controller does not properly sanitize user input, allowing an unauthenticated attacker to crash the controller software.

Recommendations For versions 2.04.560.31.03.2024 and below, consider disabling the Web interface until a patch is available to prevent potential crashes by unauthenticated attackers. Restrict access to the Web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

RCE

Weakness Enumeration

CWE-908

CWE-457

CWE-20

Related Identifiers

CVE-2024-29838

Affected Products

Evolution Controller

References · 6

• https://osv.dev/vulnerability/CVE-2024-29838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29838 · Security Note
• https://t.me/cvenotify/76690 · Telegram Post
• https://t.me/cveNotify/145356 · Telegram Post
• https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html · Note
• https://twitter.com/VulmonFeeds/status/1779748285583954335 · Twitter Post