Restricted Shell Escape in Anevia Flamingo XL 3.2.9 Enables Root Access

Publication date: 2025-12-30

Last updated on: 2025-12-30

Assigner: VulnCheck

Description

Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-30

Last Modified

2025-12-30

Generated

2026-07-06

AI Q&A

2025-12-31

EPSS Evaluated

2026-07-05

NVD

CVE-2024-58338

Affected Vendors & Products

Vendor	Product	Version / Range
anevia	flamingo_xl	3.2.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Anevia Flamingo XL 3.2.9 is a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment by exploiting the traceroute command. Attackers can inject shell commands through traceroute and gain full root access to the device, bypassing the restricted login environment.

Impact Analysis

The vulnerability can allow an attacker to gain full root access to the affected device remotely. This means the attacker can execute arbitrary commands with the highest privileges, potentially leading to complete system compromise, unauthorized data access, and control over the device.

Hi! I’m here to help you understand CVE-2024-58338. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70