CVE-2026-125399
HIGH
NVD
CVSS Score
8
Severity
HIGH
Published
Nov 10, 2026
Vendor
unknown
Description
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.
References
- https://github.com/FluxionNetwork/fluxion
- https://github.com/FluxionNetwork/fluxion/blob/v6.32/fluxion.sh#L1754-L1757
- https://github.com/FluxionNetwork/fluxion/commit/be22b0c42f21144a712b62fc072a438a012eb5d7
- https://github.com/FluxionNetwork/fluxion/releases/tag/v6.39
- https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid