Skip to main content

Ericsson CVE-2025-40842

| EUVD-2025-208983 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-03-25 ERIC
XSS Ericsson
8.5
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

6
Analysis Updated
Apr 16, 2026 - 06:16 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
2025.Q3
EUVD ID Assigned
Mar 25, 2026 - 13:30 euvd
EUVD-2025-208983
Analysis Generated
Mar 25, 2026 - 13:30 vuln.today
CVE Published
Mar 25, 2026 - 13:10 nvd
HIGH 8.5

DescriptionNVD

Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Scripting (XSS) vulnerability which, if exploited, can lead to unauthorized disclosure and modification of certain information.

AnalysisAI

A Cross-Site Scripting (XSS) vulnerability exists in Ericsson Indoor Connect 8855 versions prior to 2025.Q3, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). An attacker can inject malicious scripts into the web interface, potentially leading to unauthorized disclosure and modification of sensitive information. No CVSS score, EPSS data, or KEV status is currently available, and no public proof-of-concept has been disclosed, though the vulnerability has been formally documented by Ericsson's Product Security Incident Response Team (PSIRT).

Technical ContextAI

The vulnerability affects Ericsson Indoor Connect 8855 (CPE: cpe:2.3:a:ericsson:indoor_connect_8855:*:*:*:*:*:*:*:*), which is an enterprise wireless indoor positioning and network management system. The root cause is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). This indicates the application fails to properly sanitize or escape user-supplied input before rendering it in web responses, allowing attackers to inject arbitrary JavaScript code that executes in the context of other users' browsers. The affected component is likely the web administration interface or a client-facing portal used for managing indoor connectivity services.

RemediationAI

Upgrade Ericsson Indoor Connect 8855 to version 2025.Q3 or later immediately, as this version addresses the XSS vulnerability. Consult Ericsson's official security bulletin at https://www.ericsson.com/en/about-us/security/psirt/CVE-2025-40842 for patch availability and installation guidance. As interim mitigations, restrict network access to the Indoor Connect 8855 web administration interface to trusted IP ranges and authorized administrative subnets, deploy Web Application Firewalls (WAF) rules to detect and block common XSS payloads, implement Content Security Policy (CSP) headers if configurable, and consider placing the web interface behind a reverse proxy with request filtering until the patch can be applied.

Share

CVE-2025-40842 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy