CVE-2026-125399
OS command injection in Fluxion scanner before 6.39
- CVSS 4.0
- 8.6 high
- EPSS
- 1%p71
- Published
- ·
- Modified
Fluxion before 6.39 has an OS command injection flaw in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. An attacker within Wi-Fi range can broadcast an access point with a crafted SSID. If the operator scans or selects it, the commands run as root.
What to do: Upgrade Fluxion to 6.39 or later so the target scanner no longer evaluates crafted ESSIDs.
| Product | Affected |
|---|---|
| Fluxion | before 6.39 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.
- Weakness
- CWE-78
- Vector
- CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.