Command Execution Vulnerability in Ruckus vRIoT IoT Controller
CVE-2025-69425

10CRITICAL

Key Information:

Vendor

Ruckus Networks

Status
Vriot Iot Controller
Vendor
CVE Published:
9 January 2026

What is CVE-2025-69425?

The Ruckus vRIoT IoT Controller contains a serious command execution vulnerability due to the exposure of a service on TCP port 2004 which runs with root privileges. This service relies on authentication that uses a hardcoded Time-based One-Time Password (TOTP) secret along with an embedded static token. If an attacker successfully retrieves these credentials from the IoT controller or related compromised devices, they can generate valid authentication tokens that enable them to execute arbitrary operating system commands with root access, leading to a total compromise of the system.

Affected Version(s)

vRIoT IoT Controller 2.3.0.0 (GA) < 3.0.0.0 (GA)

vRIoT IoT Controller 2.3.1.0 (MR) < 3.0.0.0 (GA)

vRIoT IoT Controller 2.4.0.0 (GA) < 3.0.0.0 (GA)

References

https://support.ruckuswireless.com/security_bulletins/336
vendor-advisorypatch
https://www.vulncheck.com/advisories/ruckus-vriot-iot-con...
third-party-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan Racic
.