CVE-2025-69425
NONE—CVSS v3
—CVSS v2
0.03%
EPSS (exploit probability)
CWE-306CWE
Description
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.
Affected routers (0)
No routers currently mapped to this CVE in our database.