Ericsson CVE-2025-40842

Without a CVSS score, CVSS vector, or EPSS score, quantitative risk assessment is limited. However, XSS vulnerabilities (CWE-79) are historically high-impact in enterprise systems, particularly those controlling network infrastructure. The vulnerability's potential to enable unauthorized disclosure and modification of information suggests either Stored or Reflected XSS with access to sensitive administrative data. The absence of public exploit code and the March 2026 publication date suggest this is not yet actively exploited in the wild. The real-world risk depends on network exposure of the Indoor Connect 8855 web interface; if exposed to untrusted networks, the risk is elevated. Given that this is an Ericsson infrastructure product, most deployments are within controlled enterprise environments, which moderates overall risk—but affected organizations should still prioritize patching given the data confidentiality and integrity impact.

An attacker crafts a malicious URL containing embedded JavaScript and tricks an administrator into clicking it or injects the payload into a comment or configuration field if user input is stored in the Indoor Connect 8855 database. When the administrator accesses the affected page, the script executes in their browser with their authenticated session, allowing the attacker to steal session tokens, modify network configurations, or exfiltrate wireless positioning data. The attack requires social engineering or stored injection if the interface accepts unsanitized input, making it feasible in targeted campaigns against enterprise wireless deployments.