Paper/Archive/CVE-2025-27261

CVE-2025-27261

Ericsson Indoor Connect 8855 — Ericsson Indoor Connect 8855 - Improper Neutralization of Special Elements used in an SQL Command Vulnerability

EPSS 0.3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 25.8.258 × 205.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data.

Affected

ProductAffectedFixed inSource

Indoor Connect 8855< 2025.Q22025.Q2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ERIC (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refericsson.com/en/about-us/security/psirt/e2025-09-25