MajorCritical vulnerability

CVE-2026-125399 (CVSS 8.6)

NVD · officialPublished Nov 10, 2026Risk 37/100

Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.

Technical details

CVSS

8.6

AV:AdjacentAC:LowPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source