CVE-2024-29836: 
NixOS vulnerability analysis and mitigation

The Evolution Controller Web interface (Versions 2.04.560.31.03.2024 and below) contains a critical access control vulnerability identified as CVE-2024-29836. This vulnerability allows unauthenticated attackers to update and add user profiles within the application, potentially gaining full access to the site. The vulnerability was discovered and reported by security researcher Adam Foster, with an initial disclosure date of April 14, 2024 (DirectCyber).

The vulnerability is classified as an Improper Access Control (CWE-284) issue. It has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This scoring indicates that the vulnerability can be exploited remotely with no privileges or user interaction required, potentially leading to a complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability allows unauthorized attackers to create and modify user profiles, potentially leading to full administrative access to the Evolution Controller system. This could result in complete compromise of physical access control systems managed by the software, including doors, elevators, and garages (DirectCyber).

The vulnerability is highly exploitable as it requires no authentication, special privileges, or user interaction. It can be exploited remotely if the application is exposed to the internet, making it particularly dangerous for internet-facing installations (DirectCyber).

As there is currently no patch available from the vendor, DirectCyber recommends the following immediate actions: 1) Remove internet exposure of the EVO software and place it behind a separate network, 2) Change the default password to a strong alternative, 3) Contact the vendor for a patch, and 4) As a last resort, consider disabling the web interface of Evolution Controller (DirectCyber).