GHSA-7m6w-gmv7-38xjHighCVSS 8.0
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target...
🔗 CVE IDs covered (1)
📋 Description
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-125399
- https://github.com/FluxionNetwork/fluxion/commit/be22b0c42f21144a712b62fc072a438a012eb5d7
- https://github.com/FluxionNetwork/fluxion
- https://github.com/FluxionNetwork/fluxion/blob/v6.32/fluxion.sh#L1754-L1757
- https://github.com/FluxionNetwork/fluxion/releases/tag/v6.39
- https://www.vulncheck.com/advisories/fluxion-before-6.39-os-command-injection-via-crafted-ssid
- https://github.com/advisories/GHSA-7m6w-gmv7-38xj