CVE-2024-58338

Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command

Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.

Affected

Ateme · Flamingo XL

CVSS v4.0 VULNCHECK

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.78% chance of exploitation in the next 30 days, 55th percentile

Published

2025-12-30

Updated

2026-03-05

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/51516

Security advisories

• https://www.vulncheck.com/advisories/anevia-flamingo-xl-remote-root-jailbreak-via-tracero…
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5780.php
• https://www.ateme.com

References

• CVE Record
• NVD entry