Read the docs
TI-2024-38425 Aliases CVE-2024-58338GHSA-wm7p-2wcf-h9qh

Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command

Priority HIGH 72CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0078 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtemeFlamingo XL3.2.9—No fix listedCNA
  • Flamingo XL VendorAteme Affected 3.2.9 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:ateme:flamingo_xl_firmware:3.2.9:*:*:*:*:*:*:*3.2.9VulnerableAteme
cpe:2.3:h:ateme:flamingo_xl:-:*:*:*:*:*:*:*not specified by NVDRunning onAteme
  • cpe:2.3:o:ateme:flamingo_xl_firmware:3.2.9:*:*:*:*:*:*:* Versions 3.2.9 Vulnerable ·Ateme
  • cpe:2.3:h:ateme:flamingo_xl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ateme

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-58338
  2. 2026-10-03 Alias added: GHSA-wm7p-2wcf-h9qh

References

Exploit 1

Advisory 1

Other 1

  • TI-2023-30266 Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass CVSS 4.0CRITICAL 9.3
  • TI-2023-18173 An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences