Remotely Exploitable Vulnerability in Ruckus vRIoT IoT Controller Firmware

CVE-2025-69426

What is CVE-2025-69426?

The Ruckus vRIoT IoT Controller firmware prior to version 3.0.0.0 (GA) is vulnerable due to hardcoded credentials embedded in an initialization script. The SSH service is exposed to the network without adequate IP-based restrictions, allowing an attacker to gain unauthorized access. Even with configurations that disable SCP and pseudo-TTY allocation, an attacker can utilize the hardcoded credentials to authenticate, enabling SSH local port forwarding and gaining access to the Docker socket. This vulnerability permits the attacker to mount the host filesystem via Docker, potentially escaping the container and executing arbitrary commands as root on the vRIoT controller, leading to complete compromise of the system.

References