CVE-2025-69425: Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE

Severity: critical (CVSS 10.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-09 · updated 2026-06-17
Weakness: CWE-306

Description

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.

Affected products

RUCKUS Networks vRIoT IOT Controller: from 2.3.0.0 (GA) before 3.0.0.0 (GA); from 2.3.1.0 (MR) before 3.0.0.0 (GA); from 2.4.0.0 (GA) before 3.0.0.0 (GA) — fixed in 3.0.0.0 (GA)

How to fix

Upgrade to a fixed version: RUCKUS Networks vRIoT IOT Controller 3.0.0.0 (GA). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-69425 or the next vulnerability affects your stack