Ericsson CVE-2025-27260

Quantitative risk assessment is severely constrained by the absence of CVSS scores, CVSS vectors, and EPSS data. However, qualitative signals indicate moderate to significant risk: the vulnerability explicitly enables unauthorized modification of information (high technical impact on confidentiality and integrity), affects a production networking appliance deployed in enterprise indoor positioning infrastructure, and targets versions prior to 2025.Q3, suggesting a relatively recent discovery. The lack of public POC code, KEV status, and active exploitation reports suggests this is not yet widely exploited in the wild, but the complete absence of quantitative scoring metrics prevents severity comparison with other vulnerabilities. Organizations running Indoor Connect 8855 should treat this as a priority for patching based on the unauthorized modification capability and enterprise deployment context, though the actual exploitability (attack vector, privileges required, attack complexity) remains undetermined without the CVSS vector.

An attacker with network access to the Indoor Connect 8855 administrative interface or API could craft a specially formatted input payload containing unfiltered special elements (such as shell metacharacters, SQL syntax, or command delimiters) designed to bypass input validation. This malicious input, once processed by the vulnerable filtering mechanism, could be interpreted as commands or data modification directives, allowing the attacker to alter critical configuration settings, user permissions, positioning data, or system parameters without proper authorization. The specific attack complexity and required privilege level are unknown without the CVSS vector, but the vulnerability class suggests this could be exploitable by unauthenticated or low-privileged users depending on which interfaces lack proper input sanitization.