CVE-2025-40836
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Ericsson Indoor Connect 8855 contains an improper input validation vulnerability that, if exploited, can allow an attacker to execute commands with escalated privileges.
Risk Assessment
An attacker can gain elevated privileges and execute commands on the device, potentially leading to compromise of system integrity and data.
Recommendation
Update Ericsson Indoor Connect 8855 firmware to the latest version containing a fix. Restrict network access to the device.
Other vulnerabilities in Ericsson Indoor Connect 8855
See all- CVE-2025-27261Critical
Ericsson Indoor Connect 8855 contains an SQL injection vulnerability that, if exploited, can result in unauthorized disclosure or modification of data.
- CVE-2025-40837High
Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges than intended.
- CVE-2025-27262High
Ericsson Indoor Connect 8855 contains a command injection vulnerability that, if exploited, can result in an escalation of privileges.
Original NVD description (English source)
Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS