CVE-2025-69425 Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE
Attackers can extract hardcoded TOTP secrets and static tokens to execute arbitrary OS commands with root privileges on Ruckus vRIoT IoT Controllers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-69425?
CVE-2025-69425 is a critical vulnerability in RUCKUS Networks vRIoT IoT Controller, published on 9 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.
Which versions are affected by CVE-2025-69425?
How do I fix CVE-2025-69425?
No fix has been published for CVE-2025-69425 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-69425 being exploited?
There is no known exploitation of CVE-2025-69425 in the wild and no public exploit code.
Sources
Also known as GHSA-gfvg-q74f-527q.