PT-2026-1952 · Ruckus · Ruckus Vriot Iot Controller

Ivan Racic · Publicado 2026-01-09 · Atualizado 2026-01-12 · CVE-2025-69425

Positive Technologies (AI Summary)

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Ruckus vRIoT IoT Controller versions prior to 3.0.0.0 (GA)

Description The Ruckus vRIoT IoT Controller firmware exposes a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.

Recommendations Update to version 3.0.0.0 (GA) or later.

Correção

RCE

Using Hardcoded Credentials

Missing Authentication

Enumeração de Fraquezas

CWE-798

CWE-306

Identificadores relacionados

CVE-2025-69425

Produtos afetados

Ruckus Vriot Iot Controller

Referências · 6

• https://support.ruckuswireless.com/security_bulletins/336 · Correção, Aviso do Fabricante
• https://twitter.com/CVEnew/status/2009663197259743392 · Publicação no Twitter
• https://vulncheck.com/advisories/ruckus-vriot-iot-controller-hardcoded-tokens-rce · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-69425 · Nota de Segurança
• https://twitter.com/CCBalert/status/2010762148155187596 · Publicação no Twitter
• https://t.me/CVEtracker/41861 · Publicação no Telegram