Ericsson EUVD-2025-208981

The risk assessment presents a mixed signal. While CVSS and CVSS vector data are not provided, the CWE-352 classification indicates a moderate-to-high severity vulnerability typical of CSRF issues (usually CVSS 6-8 range depending on attack vector and impact scope). The absence of EPSS data and KEV inclusion status limits quantitative exploitation probability assessment, but CSRF vulnerabilities are generally considered readily exploitable by attackers with network access and moderate technical skill. The attack requires social engineering (tricking an authenticated user to visit a malicious site), which elevates practical barrier to exploitation compared to direct unauthenticated attacks. However, in enterprise environments where Indoor Connect 8855 manages critical indoor network infrastructure, a successful CSRF attack resulting in unauthorized modification could have significant operational impact. The fact that Ericsson issued an official security bulletin and patched the issue in 2025.Q3 indicates vendor acknowledgment of real-world risk rather than theoretical concern.

An attacker crafts a malicious website containing embedded requests (via hidden forms or JavaScript) targeting the Indoor Connect 8855 administrative interface. When a logged-in Indoor Connect 8855 administrator visits the attacker's site while maintaining an active session to the management console, the browser automatically includes the user's session cookie, allowing the attacker to trigger unauthorized configuration changes such as modifying network settings, creating unauthorized user accounts, or disabling security controls. The attack succeeds because Indoor Connect 8855 does not properly validate that state-changing requests originate from legitimate administrative sessions rather than external sources, making it particularly dangerous in environments where administrators maintain persistent sessions.