CVE-2025-27261
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Ericsson Indoor Connect 8855 contains an SQL injection vulnerability that, if exploited, can result in unauthorized disclosure or modification of data.
Risk Assessment
An attacker can access or modify sensitive data, potentially compromising the confidentiality and integrity of information stored on the device.
Recommendation
Update Ericsson Indoor Connect 8855 firmware to the latest version with a fix. Use parameterized SQL queries and restrict access to the device.
Other vulnerabilities in Ericsson Indoor Connect 8855
See all- CVE-2025-40836Critical
Ericsson Indoor Connect 8855 contains an improper input validation vulnerability that, if exploited, can allow an attacker to execute commands with escalated privileges.
- CVE-2025-40837High
Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges than intended.
- CVE-2025-27262High
Ericsson Indoor Connect 8855 contains a command injection vulnerability that, if exploited, can result in an escalation of privileges.
Original NVD description (English source)
Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS