Fluxion: OS Command Injection via Malicious ESSID (CVE-2026-125399)
Fluxion versions before 6.39 contain an OS command injection vulnerability in the fluxion.sh target scanner, allowing attackers within Wi-Fi range to execute commands as root.
CVE search metadata
CVE search record: CVE-2026-125399. Severity: high. CVSS: 8.0. KEV: no. Brief: Fluxion: OS Command Injection via Malicious ESSID (CVE-2026-125399). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fluxion-rce/
Triage facts
Revision 2- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 10, 09:38 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_vendors, claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
Fluxion versions before 6.39 contain an OS command injection vulnerability in the fluxion.sh target scanner. The tool decodes access point ESSIDs with eval after only escaping single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.