{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40842", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "state": "PUBLISHED", "assignerShortName": "ERIC", "dateReserved": "2025-04-16T08:59:01.744Z", "datePublished": "2026-03-25T13:10:44.010Z", "dateUpdated": "2026-03-25T13:44:10.955Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2026-03-25T13:15:53.253Z"}, "title": "Ericsson Indoor Connect 8855 - Improper Neutralization of Input During Web Page Generation Vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "affected": [{"vendor": "Ericsson", "product": "Indoor Connect 8855", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.Q3", "changes": [{"at": "2025.Q3", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3\u00a0contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information. "}]}], "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-indoorconnect-march-2026"}, {"url": "https://www.ericsson.com/en/about-us/security/psirt/CVE-2025-40842"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Telstra", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T13:44:02.789000Z", "id": "CVE-2025-40842", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:44:10.955Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40842", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T13:44:02.789000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:44:06.794Z"}}], "cna": {"title": "Ericsson Indoor Connect 8855 - Improper Neutralization of Input During Web Page Generation Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Telstra"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ericsson", "product": "Indoor Connect 8855", "versions": [{"status": "affected", "changes": [{"at": "2025.Q3", "status": "unaffected"}], "version": "0", "lessThan": "2025.Q3", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-indoorconnect-march-2026"}, {"url": "https://www.ericsson.com/en/about-us/security/psirt/CVE-2025-40842"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3\u00a0contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information.", "supportingMedia": [{"type": "text/html", "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information. ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "shortName": "ERIC", "dateUpdated": "2026-03-25T13:15:53.253Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40842", "state": "PUBLISHED", "dateUpdated": "2026-03-25T13:44:10.955Z", "dateReserved": "2025-04-16T08:59:01.744Z", "assignerOrgId": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "datePublished": "2026-03-25T13:10:44.010Z", "assignerShortName": "ERIC"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Ericsson Indoor Connect 8855 versions prior to 2025.Q3\u00a0contains a\nCross-Site Scripting (XSS) vulnerability which, if exploited, can lead to\nunauthorized disclosure and modification of certain information."}], "id": "CVE-2025-40842", "lastModified": "2026-03-25T15:41:33.977", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}]}, "published": "2026-03-25T14:16:30.570", "references": [{"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "url": "https://www.ericsson.com/en/about-us/security/psirt/CVE-2025-40842"}, {"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-indoorconnect-march-2026"}], "sourceIdentifier": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-03-25T14:35:44.190492+00:00", "value": {"mitigation_remediation": ["Apply the Ericsson Indoor Connect 8855 firmware update to the 2025.Q3 release or later to eliminate the XSS vector.", "Verify that the update is successfully installed on every affected deployment.", "If an immediate update is unavailable, apply input filtering or sanitization to all web form fields to block script tags and enforce a whitelist of allowed characters.", "Continuously monitor web server logs for attempted script injection or unexpected script execution.", "Document all remediation actions and perform a post\u2011patch penetration test to confirm that the vulnerability is fully mitigated."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting (XSS) capable of unauthorized disclosure and modification of information"}, "threat_synthesis": {"affected_systems": "The affected product is Ericsson Indoor Connect\u202f8855. All builds released prior to the 2025.Q3 update are susceptible, including any pre\u20112025.Q3 version that has not yet been upgraded.", "description_and_impact": "The vulnerability is an improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that may be executed in the browsers of legitimate users. This Cross\u2011Site Scripting flaw can lead to unauthorized disclosure of sensitive data and modification of data displayed or stored by the system, and it corresponds to CWE\u201179.", "risk_and_exploitability": "Scoring indicates a high severity with a CVSS base score of 8.5. The EPSS probability is not reported, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation may be moderate but not yet widespread. A likely attack vector involves sending crafted input through the web interface, which browsers would execute, potentially compromising the confidentiality, integrity, or availability of information presented to users."}}}}, "created": "2026-03-25T21:31:15.395315+00:00", "updated": "2026-03-25T21:31:15.395338+00:00", "vendors": []}