PT-2025-54258 · Anevia · Anevia Flamingo Xl/Xs

Published 2023-04-13 · Updated 2026-01-14 · CVE-2024-58338

Positive Technologies · (AI Summary)

CVSS v3.1

10

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anevia Flamingo XL version 3.2.9

Description The Flamingo XL IPTV station firmware contains flaws in access control. Exploitation of this issue allows a remote attacker to bypass the sandboxing protection mechanism, escalate privileges, and execute arbitrary commands. The traceroute command can be exploited to inject shell commands and gain full root access to the device, bypassing the restricted login environment.

Recommendations Versions prior to 3.2.9 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Incorrect Privilege Assignment

OS Command Injection

Weakness Enumeration

CWE-266

CWE-78

Related Identifiers

BDU:2026-00333

CVE-2024-58338

Affected Products

Anevia Flamingo Xl/Xs

References · 14

• 🔥 https://exploit-db.com/exploits/51516 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2023-5780.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58338 · Security Note
• https://bdu.fstec.ru/vul/2026-00333 · Security Note
• https://packetstorm.news/files/id/172879 · Note
• https://ateme.com · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-54258 · Note
• https://twitter.com/VulmonFeeds/status/2006248686779568374 · Twitter Post
• https://vulncheck.com/advisories/anevia-flamingo-xl-remote-root-jailbreak-via-traceroute-command · Note
• https://twitter.com/CveFindCom/status/2006148070686216545 · Twitter Post
• https://twitter.com/CCBalert/status/2011433880960528575 · Twitter Post
• https://github.com/advisories/GHSA-wm7p-2wcf-h9qh · Note
• https://t.me/CVEtracker/41014 · Telegram Post
• https://twitter.com/CVEnew/status/2006332236539547778 · Twitter Post