CVE-2024-29843

Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration

7.5 High

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.50%Up 0.5 points since Apr 15, 2024

What each source reports

CVE List Score used 7.5

Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration

Record: CVE-2024-29843
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-284
Updated: 2026-11-02

EUVDEUVD-2024-26835 7.5

Record: EUVD-2024-26835
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2rfp-5w3v-6w75 7.5

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly...

Record: GHSA-2rfp-5w3v-6w75
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

NVD 7.5

Record: CVE-2024-29843
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-284
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-29843 is a high vulnerability (CVSS 7.5) in Cs Technologies Australia Evolution Controller, published April 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. No source names a fixed version.