FLUXION · CVE-2026-125399 · Other
NO FIX YET · SEE WHAT TO DO
Fluxion, a Wi-Fi security auditing tool, decodes access point network names (ESSIDs) with eval after escaping only single quotes. A nearby attacker who broadcasts an access point with a crafted name can run commands as root when the operator scans or selects it.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running Fluxion versions before 6.39 on a machine they use for Wi-Fi auditing. The attacker needs to be within Wi-Fi range and the operator must scan or select the crafted access point. Teams that do not run Fluxion are not affected.
Not affected if fluxion-6.39-or-later, no-fluxion-installed
Who cares fluxion, linux, pentest, wifi
git -C fluxion log -1 if it was cloned from git; unknown if the sources do not give another method.fluxion.sh and confirm whether it uses eval on ESSIDs; unknown if the sources do not say more.6.39 or later.Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.