CVE-2025-69426
CriticalSummary
Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 contain hardcoded credentials for an OS user account in an initialization script. An attacker can use these credentials to authenticate via SSH and access the Docker socket, allowing container escape and execution of commands as root.
Risk Assessment
A remote attacker can gain full control of the controller, potentially leading to system integrity compromise, data theft, or disruption of IoT services.
Recommendation
Upgrade the firmware to version 3.0.0.0 or later immediately. If not possible, restrict network access to SSH and change default credentials.
Original NVD description (English source)
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY allocation, an attacker can authenticate using the hardcoded credentials and establish SSH local port forwarding to access the Docker socket. By mounting the host filesystem via Docker, an attacker can escape the container and execute arbitrary OS commands as root on the underlying vRIoT controller, resulting in complete system compromise.