Vulnerability · Published Jan 9, 2026 · Assigned by VulnCheck

CVE-2025-69425Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE

Critical 10.0

In plain English

A critical-severity missing authentication in vRIoT IoT Controller from RUCKUS Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 4.0)10.0Critical

Exploit odds (30 days)0.9%top 41.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.

Affected products (as reported)

Vendor	Product	Versions
RUCKUS Networks	vRIoT IoT Controller	2.3.0.0 (GA) – before 3.0.0.0 (GA)2.3.1.0 (MR) – before 3.0.0.0 (GA)2.4.0.0 (GA) – before 3.0.0.0 (GA)

Weakness: CWE-306, CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://support.ruckuswireless.com/security_bulletins/336 vendor-advisory, patch
https://www.vulncheck.com/advisories/ruckus-vriot-iot-controller-hardcoded-tokens-rce third-party-advisory