CVE-2026-125399

HIGH 8.0

Fluxion before 6.39 OS Command Injection via Crafted SSID

CVSS Score

8.0

EPSS Score

0.0%

EPSS Percentile

0th

Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.

CWE	CWE-78
Vendor	fluxionnetwork
Product	fluxion
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for fluxionnetwork fluxion

Be the first to know when new high vulnerabilities affecting fluxionnetwork fluxion are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

FluxionNetwork / fluxion

0 < 6.39

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FluxionNetwork/fluxion/commit/be22b0c42f21144a712b62fc072a438a012eb5d7 github.com: https://github.com/FluxionNetwork/fluxion github.com: https://github.com/FluxionNetwork/fluxion/blob/v6.32/fluxion.sh#L1754-L1757 github.com: https://github.com/FluxionNetwork/fluxion/releases/tag/v6.39 vulncheck.com: https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid

Credits

Umut SEVİNÇ (VulnSVNC) strasharo