CVE-2025-69426 | The Ruckus vRIoT IoT Controller firmware versions prior to 3… | CVSS 10.0 CRITICAL

Description

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY allocation, an attacker can authenticate using the hardcoded credentials and establish SSH local port forwarding to access the Docker socket. By mounting the host filesystem via Docker, an attacker can escape the container and execute arbitrary OS commands as root on the underlying vRIoT controller, resulting in complete system compromise.

Metadata

CVE ID: CVE-2025-69426
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-01-08 20:48 UTC
Published: 2026-01-09 16:15 UTC
Last updated: 2026-07-28 01:48 UTC
Primary CWE: CWE-732
CWE-732 Incorrect Permission Assignment for Critical Resourc…
Vendor / Product: RUCKUS Networks / vRIoT IOT Controller
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
RUCKUS Networks	vRIoT IOT Controller	—	2.3.0.0 (GA) < 3.0.0.0 (GA), 2.3.1.0 (MR) < 3.0.0.0 (GA), 2.4.0.0 (GA) < 3.0.0.0 (GA)

Weakness (CWE)

CWE	Source	Description
CWE-732	cna	CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-798	cna	CWE-798 Use of Hard-coded Credentials

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (2)