Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2025-69425

Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

RUCKUS Networks vRIoT IoT Controller

Default version status: unaffected

  • 2.3.0.0 (GA) to < 3.0.0.0 (GA)affected
  • 2.3.1.0 (MR) to < 3.0.0.0 (GA)affected
  • 2.4.0.0 (GA) to < 3.0.0.0 (GA)affected

References