CVE-2025-69425

Critical

Published: 09/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 expose a command execution service on TCP port 2004 running with root privileges. Authentication relies on a hardcoded TOTP secret and static token, allowing an attacker to execute arbitrary OS commands.

Risk Assessment

An attacker who obtains the credentials can execute arbitrary commands with root privileges, leading to complete system compromise and data breach.

Recommendation

Upgrade the firmware to version 3.0.0.0 or later immediately. If not possible, block access to port 2004 and change all default secrets.

Original NVD description (English source)

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.