CVE-2025-27261 is a Critical (CVSS 9.8) SQL injection in Ericsson Indoor Connect 8855 that can lead to unauthorised disclosure or modification of data. Ericsson's notice dated 25 September 2025 has the details, so read it and apply the update it names.
What's affected
Affected, per the record: Ericsson Indoor Connect 8855 and its firmware. The record does not give version ranges or a fixed firmware version.
Ericsson's PSIRT notice e2025-09-25 is the vendor source. My fetch of that page was blocked by a browser check, so I could not confirm the fixed firmware version, and you should read the notice yourself or ask Ericsson support before planning a rollout.
Indoor Connect is in-building cellular equipment, so devices are often spread across many sites and managed by a service provider.
How to check if you're exposed
Work from your device inventory. List the Indoor Connect 8855 units, their firmware versions and the management network each sits on.
If the units are managed through a controller or an operator portal, the portal usually shows the firmware version. Compare that with the version in Ericsson's notice.
Then check how the management interface of each device can be reached. It should only be reachable from the management network:
nmap -Pn -p 80,443 your-device-address
Run this only against devices you are authorised to scan. If the web interface answers from user networks or from the internet, restrict it.
Check whether any logs are collected from the units, and review them for unexpected administrative requests.
What to do now
- List every Indoor Connect 8855 unit and its firmware version.
- Read the Ericsson PSIRT notice and confirm the fixed firmware.
- Plan and apply the firmware update, starting with units on the most exposed networks.
- Restrict access to device management interfaces to the management network only.
- If a service provider manages the units, ask them to confirm the update status in writing.
- Review configuration for changes you did not make.
Why it matters
The record lists CWE-89. A SQL command is built from input that is not properly cleaned, so the input can change the command. On a device, the database may hold configuration, credentials or operating data.
The vector is network based with no privileges and no user interaction, and scores high impact on confidentiality, integrity and availability. The vendor wording is short: unauthorised disclosure or modification of data. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog. The record does not say the flaw is used in attacks.
Embedded devices rarely have an automatic update path, so someone has to own the firmware list and the schedule. Add these units to the same patch tracking you use for servers.
Quick check
Which firmware version fixes it?
The record does not say, and I could not read Ericsson's notice in full. Check the notice for the fixed firmware and apply that.
Is this device internet facing?
It should not be. Keep management interfaces on a private management network and test that from outside.
Sources
Last reviewed: 19 October 2026.
