Home

Description

Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.

PUBLISHED Reserved 2025-12-26 | Published 2025-12-30 | Updated 2026-01-16 | Assigner VulnCheck




HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CRITICAL: 10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unaffected

3.2.9
affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5780.php exploit

www.exploit-db.com/exploits/51516 (ExploitDB-51516) exploit

www.ateme.com (Ateme Vendor Homepage) product

www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5780.php (Zero Science Lab Disclosure (ZSL-2023-5780)) third-party-advisory

www.vulncheck.com/...e-root-jailbreak-via-traceroute-command (VulnCheck Advisory: Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command) third-party-advisory

cve.org (CVE-2024-58338)

nvd.nist.gov (CVE-2024-58338)

Download JSON