CVE-2025-69426: Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCE
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY allocation, an attacker can authenticate using the hardcoded credentials and establish SSH local port forwarding to access the Docker socket. By mounting the host filesystem via Docker, an attacker can escape the container and execute arbitrary OS commands as root on the underlying vRIoT controller, resulting in complete system compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ruckus vRIoT IoT Controllerto a version that resolves this vulnerability.Fixed in 3.0.0.0 - Compensating control
Restrict network access to the SSH service (add IP-based restrictions or firewall/ACL rules) because the SSH service is network-accessible without IP-based restrictions.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69426?
CVE-2025-69426 has a high severity due to the presence of hardcoded credentials and accessible SSH service.
How do I fix CVE-2025-69426?
To fix CVE-2025-69426, upgrade the Ruckus vRIoT IoT Controller to firmware version 3.0.0.0 or newer.
What are the risks associated with CVE-2025-69426?
The risks include unauthorized access due to hardcoded credentials and potential exploitation of the accessible SSH service.
Which versions of the Ruckus vRIoT IoT Controller are affected by CVE-2025-69426?
All versions prior to 3.0.0.0 of the Ruckus vRIoT IoT Controller are affected by CVE-2025-69426.
Is remote code execution possible with CVE-2025-69426?
Yes, the vulnerability may allow remote code execution due to the hardcoded credentials and SSH access.