Double Critical: Hardcoded Secrets Expose Ruckus IoT Controllers to Root RCE

A pair of critical vulnerabilities in the Ruckus vRIoT IoT Controller have been disclosed, each carrying a maximum CVSS score of 10.0 and enabling potential full system compromise on firmware versions prior to 3.0.0.0 (GA). The flaws, CVE-2025-69425 and CVE-2025-69426, arise from hardcoded secrets that attackers can use to bypass authentication and gain root privileges.

The first involves a command execution service on TCP port 2004 that relies on a hardcoded Time-based One-Time Password secret and an embedded static token, allowing an attacker to run arbitrary OS commands as root. The second flaw uses hardcoded credentials for an OS user in an initialization script, which can be exploited to authenticate via SSH and establish local port forwarding to escape Docker and mount the host filesystem, effectively compromising the underlying controller.

Ruckus has addressed both issues in firmware version 3.0.0.0 (GA), and administrators are urged to upgrade immediately to remove the hardcoded credentials and close these attack vectors. 13 January 2026.