{"id":"CVE-2026-125399","kind":"vulnerability","aliases":["CVE-2026-125399"],"related":[],"title":"Fluxion: crafted Wi-Fi network name runs commands as root","description":"Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.","summary":"Fluxion, a Wi-Fi security auditing tool, decodes access point network names (ESSIDs) with eval after escaping only single quotes. A nearby attacker who broadcasts an access point with a crafted name can run commands as root when the operator scans or selects it.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Fluxion","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fluxion","linux","other","pentest","wifi"],"not_affected_if":["fluxion-6.39-or-later","no-fluxion-installed"],"how_to_check":"- Check the installed Fluxion version in its directory, for example with `git -C fluxion log -1` if it was cloned from git; unknown if the sources do not give another method.\n- Look for the target scanner `fluxion.sh` and confirm whether it uses eval on ESSIDs; unknown if the sources do not say more.","fix":"- Fluxion: upgrade to `6.39` or later.","status":"open","published_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:29:46+00:00","updated_at":"2026-11-10T00:29:46+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T00:29:46Z","model":"claude-haiku-5-5","output":{"fix":"- Fluxion: upgrade to `6.39` or later.","reach":"network","title":"Fluxion: crafted Wi-Fi network name runs commands as root","impact":"high","summary":"Fluxion, a Wi-Fi security auditing tool, decodes access point network names (ESSIDs) with eval after escaping only single quotes. A nearby attacker who broadcasts an access point with a crafted name can run commands as root when the operator scans or selects it.","audience":"developers","category":"other","nicknames":[],"who_cares":["fluxion","pentest","linux","wifi"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Commands run as root on the operator's machine.","analyst_note":"","how_to_check":"- Check the installed Fluxion version in its directory, for example with `git -C fluxion log -1` if it was cloned from git; unknown if the sources do not give another method.\n- Look for the target scanner `fluxion.sh` and confirm whether it uses eval on ESSIDs; unknown if the sources do not say more.","plain_action":"","product_name":"Fluxion","needs_analyst":false,"not_affected_if":["fluxion-6.39-or-later","no-fluxion-installed"],"who_is_affected":"Anyone running Fluxion versions before 6.39 on a machine they use for Wi-Fi auditing. The attacker needs to be within Wi-Fi range and the operator must scan or select the crafted access point. Teams that do not run Fluxion are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4616,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125399':14A,17A '-2026':13A,16A '6.39':70C 'access':33B,51B,84C,103C 'attack':47B,94C 'audit':30B 'broadcast':49B,101C 'command':9A,59B,74C,111C 'contain':71C 'craft':2A,55B,107C 'cve':12A,15A 'decod':32B,83C 'escap':41B,90C 'essid':37B,86C 'eval':39B,88C 'execut':110C 'fi':5A,28B,98C 'fluxion':1A,18A,19B,24B,68C 'fluxion.sh':79C 'inject':75C 'linux':20B 'name':7A,36B,56B 'nearbi':46B 'network':6A,35B 'oper':64B,116C 'os':73C 'pentest':22B 'point':34B,52B,85C,104C 'quot':44B,93C 'rang':99C 'root':11A,61B,113C 'run':8A,58B 'scan':65B,117C 'scanner':81C 'secur':29B 'select':67B,119C 'singl':43B,92C 'ssid':108C 'target':80C 'tool':31B 'vulner':76C 'wi':4A,27B,97C 'wi-fi':3A,26B,96C 'wifi':23B 'within':95C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Fluxion versions before 6.39 on a machine they use for Wi-Fi auditing. The attacker needs to be within Wi-Fi range and the operator must scan or select the crafted access point. Teams that do not run Fluxion are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["fluxion"],"ptokens":["fluxion"],"labels":["fluxion","high","linux","other","pentest","vendor","wifi"],"campaign_type":null,"search_a":"'-125399':14A,17A '-2026':13A,16A 'command':9A 'craft':2A 'cve':12A,15A 'fi':5A 'fluxion':1A,18A 'name':7A 'network':6A 'root':11A 'run':8A 'wi':4A 'wi-fi':3A","search_b":"'access':33B,51B 'attack':47B 'audit':30B 'broadcast':49B 'command':59B 'craft':55B 'decod':32B 'escap':41B 'essid':37B 'eval':39B 'fi':28B 'fluxion':19B,24B 'linux':20B 'name':36B,56B 'nearbi':46B 'network':35B 'oper':64B 'pentest':22B 'point':34B,52B 'quot':44B 'root':61B 'run':58B 'scan':65B 'secur':29B 'select':67B 'singl':43B 'tool':31B 'wi':27B 'wi-fi':26B 'wifi':23B","search_c":"'6.39':70C 'access':84C,103C 'attack':94C 'broadcast':101C 'command':74C,111C 'contain':71C 'craft':107C 'decod':83C 'escap':90C 'essid':86C 'eval':88C 'execut':110C 'fi':98C 'fluxion':68C 'fluxion.sh':79C 'inject':75C 'oper':116C 'os':73C 'point':85C,104C 'quot':93C 'rang':99C 'root':113C 'scan':117C 'scanner':81C 'select':119C 'singl':92C 'ssid':108C 'target':80C 'vulner':76C 'wi':97C 'wi-fi':96C 'within':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125399","severity":null,"published_at":"2026-11-10T00:17:14+00:00","modified_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null}],"documents":[{"id":111599,"url":"https://github.com/FluxionNetwork/fluxion/commit/be22b0c42f21144a712b62fc072a438a012eb5d7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111600,"url":"https://github.com/FluxionNetwork/fluxion/releases/tag/v6.39","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111601,"url":"https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}