---
id: "CVE-2026-125399"
page: "https://infrastack.ai/live/CVE-2026-125399"
kind: "vulnerability"
aliases: ["CVE-2026-125399"]
title: "Fluxion: crafted Wi-Fi network name runs commands as root"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Fluxion", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["fluxion", "linux", "other", "pentest", "wifi"]
not_affected_if: ["fluxion-6.39-or-later", "no-fluxion-installed"]
published_at: "2026-11-10T00:17:14+00:00"
first_seen_at: "2026-11-10T00:28:44+00:00"
updated_at: "2026-11-10T00:29:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125399", "first_seen_at": "2026-11-10T00:28:44+00:00"}]
exploit_sources: []
---

# Fluxion: crafted Wi-Fi network name runs commands as root

Link for people: https://infrastack.ai/live/CVE-2026-125399 (this .md is for agents)

Fluxion, a Wi-Fi security auditing tool, decodes access point network names (ESSIDs) with eval after escaping only single quotes. A nearby attacker who broadcasts an access point with a crafted name can run commands as root when the operator scans or selects it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fluxion affected range not listed fixed no fixed version listed

## How to check

- Check the installed Fluxion version in its directory, for example with `git -C fluxion log -1` if it was cloned from git; unknown if the sources do not give another method.
- Look for the target scanner `fluxion.sh` and confirm whether it uses eval on ESSIDs; unknown if the sources do not say more.

## Fix

- Fluxion: upgrade to `6.39` or later.

## Timeline

- 2026-11-10T00:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125399

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid
- [fix] Patch: github.com https://github.com/FluxionNetwork/fluxion/commit/be22b0c42f21144a712b62fc072a438a012eb5d7
- [fix] Release notes: github.com https://github.com/FluxionNetwork/fluxion/releases/tag/v6.39

## From the sources

Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_