Vulnerability · Published Dec 30, 2025 · Assigned by VulnCheck
CVE-2024-58338Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command
Critical 10.0
In plain English
A critical-severity OS command injection in Flamingo XL from Ateme. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.8%top 43.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ateme | Flamingo XL | 3.2.9 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- ExploitDB-51516 exploit
- Ateme Vendor Homepage product
- Zero Science Lab Disclosure (ZSL-2023-5780) third-party-advisory
- VulnCheck Advisory: Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command third-party-advisory