CVE-2026-125399: Fluxion before 6.39 OS Command Injection via Crafted SSID
Published Nov 9, 2026
·Updated
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.
Affected Software
1 affected component
Fluxion Fluxion<6.39
Event History
Nov 9, 2026
CVE Published
via MITRE·11:28 PM
Data Sourced
via MITRE·11:28 PM
DescriptionSeverityWeakness
Nov 10, 2026
Data Sourced
via NVD·12:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need access to the target system or Wi-Fi network credentials?
No. An attacker only needs to be within Wi-Fi range and able to broadcast a crafted access point SSID; no privileges on the Fluxion host are required.
2
What operator action triggers exploitation?
The crafted SSID is processed when the operator scans for access points or selects the malicious access point. Successful exploitation can execute commands with root privileges.