VulnerabilityModified
CVE-2024-58338
Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command.
HIGH 8.6EPSS 0.79%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.
- CVSS 4.0
- 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.79% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- ateme/flamingo xl firmware
- Source
- disclosure@vulncheck.com
References
- https://www.ateme.comProduct
- https://www.exploit-db.com/exploits/51516Exploit, Third Party Advisory
- https://www.vulncheck.com/advisories/anevia-flamingo-xl-remote-root-jailbreak-via-traceroute-commandThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5780.phpThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5780.phpThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.