Critical severity · published Sep 25, 2025
CVE-2025-40836
Ericsson Indoor Connect 8855 - Improper Input Validation Vulnerability
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Indoor Connect 8855 · Ericsson
before 2025.Q2 · source: vendor
IC
Indoor Connect 8855 Firmware · Ericsson
before 2025.q2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40836
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40836
Vendor Advisory
https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25
More from Indoor Connect 8855
9.8
CVE-2025-27261
Ericsson Indoor Connect 8855 - Improper Neutralization of Special Elements used in an SQL Command Vulnerability
8.8
CVE-2025-40837
Ericsson Indoor Connect 8855 - Missing Authorization Vulnerability
7.8
CVE-2025-27262
Ericsson Indoor Connect 8855 - Improper Neutralization of Special Elements used in an OS Command Vulnerability
7.5
CVE-2025-27260
Ericsson Indoor Connect 8855 - Improper Filtering of Special Elements Vulnerability
7.5
CVE-2025-40838
Ericsson Indoor Connect 8855 - Insufficiently Protected Credentials Vulnerability