CVE-2025-69425CWE-306CWE-798

Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE

Critical · published January 9, 2026

CVSS v4.0
10.0
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00861 · 58.1th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-798 · Use of Hard-coded Credentials
Published
2026-01-09T16:14Z
EPSS history
Timeline
  • 09 JAN 16:14Z
    Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE
    cvelistv5