by Kastro
Paper/Archive/CVE-2024-58338

CVE-2024-58338

Ateme Flamingo XL — Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command

EPSS 0.8%public exploitCVSS 10.0
critical.is priorityof 100
51
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.

Affected

ProductAffectedFixed inSource
Flamingo XL3.2.9–CNA

Scores by source

VulnCheck (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
VulnCheck (CNA)8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitexploit-db.com/exploits/51516refateme.comexploitzeroscience.mk/en/vulnerabilities/ZSL-2023-5780.phpwriteupvulncheck.com/advisories/anevia-flamingo-xl-remote-root-jailbreak-via-traceroute-command