CVE-2024-58338 | THREATINT

Description

Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.

PUBLISHED Reserved 2025-12-26 | Published 2025-12-30 | Updated 2025-12-30 | Assigner VulnCheck

HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Incorrect Privilege Assignment

Product status

3.2.9

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.exploit-db.com/exploits/51516 (ExploitDB-51516) exploit

www.ateme.com (Ateme Vendor Homepage) product

www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5780.php (Zero Science Lab Disclosure (ZSL-2023-5780)) third-party-advisory

www.vulncheck.com/...e-root-jailbreak-via-traceroute-command (VulnCheck Advisory: Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command) third-party-advisory

cve.org (CVE-2024-58338)

nvd.nist.gov (CVE-2024-58338)

Download JSON