{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40842", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "state": "PUBLISHED", "assignerShortName": "ERIC", "dateReserved": "2025-04-16T08:59:01.744Z", "datePublished": "2026-03-25T13:10:44.010Z", "dateUpdated": "2026-03-25T13:44:10.955Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2026-03-25T13:15:53.253Z"}, "title": "Ericsson Indoor Connect 8855 - Improper Neutralization of Input During Web Page Generation Vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "affected": [{"vendor": "Ericsson", "product": "Indoor Connect 8855", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.Q3", "changes": [{"at": "2025.Q3", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3\u00a0contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information. "}]}], "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-indoorconnect-march-2026"}, {"url": "https://www.ericsson.com/en/about-us/security/psirt/CVE-2025-40842"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Telstra", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T13:44:02.789000Z", "id": "CVE-2025-40842", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:44:10.955Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40842", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T13:44:02.789000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:44:06.794Z"}}], "cna": {"title": "Ericsson Indoor Connect 8855 - Improper Neutralization of Input During Web Page Generation Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Telstra"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ericsson", "product": "Indoor Connect 8855", "versions": [{"status": "affected", "changes": [{"at": "2025.Q3", "status": "unaffected"}], "version": "0", "lessThan": "2025.Q3", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-indoorconnect-march-2026"}, {"url": "https://www.ericsson.com/en/about-us/security/psirt/CVE-2025-40842"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3\u00a0contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information.", "supportingMedia": [{"type": "text/html", "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information. ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2026-03-25T13:15:53.253Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40842", "state": "PUBLISHED", "dateUpdated": "2026-03-25T13:44:10.955Z", "dateReserved": "2025-04-16T08:59:01.744Z", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "datePublished": "2026-03-25T13:10:44.010Z", "assignerShortName": "ERIC"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ericsson:indoor_connect_8855_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "37C4F98B-D38A-47A6-B294-23A5E6291A81", "versionEndExcluding": "2025.q3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ericsson:indoor_connect_8855:-:*:*:*:*:*:*:*", "matchCriteriaId": "3B0C1261-B15A-4D91-AC65-9834D16A94F1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3\u00a0contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information."}, {"lang": "es", "value": "Las versiones de Ericsson Indoor Connect 8855 anteriores a 2025.Q3 contienen una vulnerabilidad de cross-site scripting (XSS) que, si se explota, puede conducir a la divulgaci\u00f3n y modificaci\u00f3n no autorizada de cierta informaci\u00f3n."}], "id": "CVE-2025-40842", "lastModified": "2026-03-27T18:27:30.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}]}, "published": "2026-03-25T14:16:30.570", "references": [{"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "tags": ["Vendor Advisory"], "url": "https://www.ericsson.com/en/about-us/security/psirt/CVE-2025-40842"}, {"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "tags": ["Vendor Advisory"], "url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-indoorconnect-march-2026"}], "sourceIdentifier": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025.Q3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[2025.Q3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Indoor Connect 8855", "source": "cna", "vendor": "Ericsson"}, "product": "indoor_connect_8855", "vendor": "ericsson"}], "analysis": {"en": {"generated_at": "2026-03-27T19:53:19.925732+00:00", "value": {"mitigation_remediation": ["Upgrade the device to Ericsson Indoor Connect 8855 firmware version 2025.Q3 or later following Ericsson\u2019s PSIRT advisory instructions.", "Verify the firmware version after the update and reboot the device to apply the change.", "If an update is not immediately available, isolate the web interface to a trusted network segment or restrict access to the device\u2019s management port.", "Restrict or disable any user\u2011controlled input fields that are not essential for operation to reduce exposure to script injection.", "Monitor user activity for anomalous script execution and consult Ericsson\u2019s security bulletin for additional configuration guidance."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting that permits unauthorized disclosure and modification of information"}, "threat_synthesis": {"affected_systems": "All units of Ericsson Indoor Connect 8855 that run firmware dated prior to the 2025.Q3 release are impacted. This includes the hardware platform that hosts the indoor positioning software as well as the firmware that provides the web interface for configuration and monitoring.", "description_and_impact": "The vulnerability is an improper neutralization of input during web page generation in Ericsson Indoor Connect 8855 versions released before 2025.Q3. It allows an attacker to inject malicious scripts into pages served by the device, enabling theft or alteration of data visible to a web\u2011browser user. This client\u2011side input sanitization flaw is a classic Reflected Cross\u2011Site Scripting weakness (CWE\u201179).", "risk_and_exploitability": "The flaw scores a high CVSS score of 8.5, yet the EPSS score is below 1\u202f%, indicating that while the potential impact is severe, current exploitation risk is low. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an attacker crafting a malicious URL or payload that is passed through the device\u2019s web interface, which a victim\u2019s browser then renders. Such an attack would require an authenticated or unauthenticated user to view the affected web page but no further system compromise is required."}}}}, "created": "2026-03-25T21:31:15.395315+00:00", "updated": "2026-03-27T20:26:35.585780+00:00", "vendors": ["ericsson", "ericsson$PRODUCT$indoor_connect_8855"]}