What’s Vulnerable › Vulnerabilities

CVE-2024-58338: Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-30 · updated 2026-06-17
• Weakness: CWE-78

Description

Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.

Affected products

• Ateme Flamingo XL: 3.2.9

References

• https://www.ateme.com
• https://www.exploit-db.com/exploits/51516
• https://www.vulncheck.com/advisories/anevia-flamingo-xl-remote-root-jailbreak-via-traceroute-command
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5780.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5780.php

Get alerted when CVE-2024-58338 or the next vulnerability affects your stack