CVE-2025-69426
CRITICAL EPSS 30.6%
Published Jan 9, 20265mo ago · Modified Jun 17, 20261w ago
10.0 CVSS 4.0
Published Jan 9, 2026 5mo ago
Last Modified Jun 17, 2026 1w ago
Description
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY allocation, an attacker can authenticate using the hardcoded credentials and establish SSH local port forwarding to access the Docker socket. By mounting the host filesystem via Docker, an attacker can escape the container and execute arbitrary OS commands as root on the underlying vRIoT controller, resulting in complete system compromise.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
30.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-732
CWE-798 Use of Hard-coded Credentials Authentication
References 2
- support.ruckuswireless.com https://support.ruckuswireless.com/security_bulletins/336
- vulncheck.com https://www.vulncheck.com/advisories/ruckus-vriot-iot-controller-hardcoded-ssh-credentials-rce
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.