CVE-2024-29836: 
NixOS vulnerability analysis and mitigation

The Evolution Controller Web interface (Versions 2.04.560.31.03.2024 and below) contains a critical access control vulnerability identified as CVE-2024-29836. This vulnerability allows unauthenticated attackers to update and add user profiles within the application, potentially gaining full access to the site. The vulnerability was discovered and reported by security researcher Adam Foster, with an initial disclosure date of April 14, 2024 (DirectCyber).

The vulnerability is classified as an Improper Access Control (CWE-284) issue. It has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This scoring indicates that the vulnerability can be exploited remotely with no privileges or user interaction required, potentially leading to a complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability allows unauthorized attackers to create and modify user profiles, potentially leading to full administrative access to the Evolution Controller system. This could result in complete compromise of physical access control systems managed by the software, including doors, elevators, and garages (DirectCyber).

As there is currently no patch available from the vendor, DirectCyber recommends the following immediate actions: 1) Remove internet exposure of the EVO software and place it behind a separate network, 2) Change the default password to a strong alternative, 3) Contact the vendor for a patch, and 4) As a last resort, consider disabling the web interface of Evolution Controller (DirectCyber).