RCE in Fluxionnetwork Fluxion
CVE-2026-125399
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS 0.013, 70.8th percentile (scored ). About EPSS.
Affected products
Weakness classification (CWE)
Public exploits and proof-of-concept code
1 public repository with exploit or proof-of-concept code for this CVE:
- VulnSVNC/CVE-2026-125399 (1 star, last pushed 2026-11-10): Zero-Click, Unauthenticated OS Command Injection via eval() on Attacker-Controlled ESSID in Fluxion
References
- github.com/FluxionNetwork/fluxion/commit/be22b0c42f21144a712b62fc072a438a012eb5… (patch)
- github.com/FluxionNetwork/fluxion (product)
- github.com/FluxionNetwork/fluxion/blob/v6.32/fluxion.sh (technical-description)
- github.com/FluxionNetwork/fluxion/releases/tag/v6.39 (release-notes)
- www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-craft… (third-party-advisory)
This CVE has public exploit evidence. See the latest CVEs with public exploits.