CVE-2026-125399 | BDVDB-2026-402643 Detail
FluxionNetworkfluxion
Description#
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: adjacent.
Weaknesses#
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References#
- https://github.com/FluxionNetwork/fluxion/commit/be22b0c42f21144a712b62fc072a438a012eb5d7
- https://github.com/FluxionNetwork/fluxion
- https://github.com/FluxionNetwork/fluxion/blob/v6.32/fluxion.sh#L1754-L1757
- https://github.com/FluxionNetwork/fluxion/releases/tag/v6.39
- https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.