CVE-2025-69426 Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCE
Hardcoded SSH credentials allow attackers to access the Docker socket, escape the container, and execute arbitrary commands as root on the IoT controller.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-69426?
CVE-2025-69426 is a critical vulnerability in RUCKUS Networks vRIoT IOT Controller, published on 9 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY allocation, an attacker can authenticate using the hardcoded credentials and establish SSH local port forwarding to access the Docker socket. By mounting the host filesystem via Docker, an attacker can escape the container and execute arbitrary OS commands as root on the underlying vRIoT controller, resulting in complete system compromise.
Which versions are affected by CVE-2025-69426?
How do I fix CVE-2025-69426?
No fix has been published for CVE-2025-69426 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-69426 being exploited?
There is no known exploitation of CVE-2025-69426 in the wild and no public exploit code.
Sources
Also known as GHSA-q3qv-m4mc-pj49.