CVE-2024-29844

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1392

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-298468.0An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same CVE-2024-298479.8Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenti CVE-2024-298487.2An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to exec CVE-2024-298499.8Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.CVE-2024-29858.8A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects the function formQuick CVE-2024-298508.8Veeam Backup Enterprise Manager allows account takeover via NTLM relay.CVE-2024-298517.2Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.CVE-2024-298522.7Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.CVE-2024-298537.8An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation.CVE-2024-298559.0Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator CVE-2024-298577.5An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before CVE-2024-298589.8In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.