CVE-2025-40836 is a critical command execution flaw in Ericsson Indoor Connect 8855, with a CVSS score of 9.8. The record gives no fixed firmware version, so read the Ericsson PSIRT bulletin. Treat any instance reachable from untrusted networks as exposed until you have confirmed the fix, and review your logs for unexpected requests.
What's affected
- Product: Ericsson Indoor Connect 8855 and its firmware, an indoor cellular connectivity product.
- Fixed version: The record does not give a fixed firmware version. Ericsson published a PSIRT bulletin dated 2025-09-25, which was not readable when this post was prepared, so read it for fixed versions.
- Severity: Critical, CVSS 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Weakness: CWE-20.
- Published: 2025-09-25.
The record describes an improper input validation flaw that, if exploited, can allow an attacker to execute commands with escalated privileges. It gives no endpoint, parameter or version range.
The record scores it 9.8 with a network attack vector, low complexity, no privileges and no user interaction. That is a very severe profile.
How to check if you're exposed
- Find the Indoor Connect 8855 units in your asset records and note each firmware version.
- Compare them with the list in the Ericsson PSIRT bulletin.
- Check which networks can reach the management interface of each unit.
You can also run your dependency manifests and container images through the free in-browser scan to see which known CVEs affect the packages you ship. It will not find a flaw inside a vendor appliance or an unmanaged install, so keep an inventory of those too.
What to do now
- Identify every copy of Ericsson Indoor Connect 8855 you run, including test and forgotten ones.
- Open the Ericsson PSIRT bulletin, match your firmware to its list, and apply the fixed firmware it names.
- Until that is done, remove public access where you can. Put the application behind a VPN, a network allow list or a web application firewall rule, and watch the access and database logs for unusual requests to the endpoint named above.
- Record the outcome, including the date, the version you ended on and who confirmed it, so a later audit has something to read.
- Add the product to your continuous monitoring so a future CVE against it reaches you without a manual search.
Why it matters
Improper input validation means the product accepts data without checking that it is safe, then uses it in a way that lets the data act as a command. The record gives no further detail on this one, so the exact path is something only the vendor bulletin can confirm. The class is catalogued as CWE-20 (improper input validation).
For network equipment the wider lesson is about management exposure. Devices like this should not have administrative interfaces reachable from untrusted networks, whatever the patch status.
The record's KEV flag is false, so CISA does not list it as known to be exploited, and nothing in the sources here says it is being exploited in the wild.
Try it yourself
See how the fix available now step works in practice.
Click through it at your own pace, or open it full screen.
Quick check
What does the score of 9.8 mean for Ericsson Indoor Connect 8855?
The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reads as network reachable, low complexity, no privileges and no user interaction. The impact ratings are confidentiality high, integrity high, availability high. Use it to rank the work, then confirm exposure for your own deployment.
Do I need the exact flaw details to act on this?
No. The record gives a critical score and a clear remedy path: find the fixed firmware in the vendor bulletin and apply it, and keep management interfaces off untrusted networks.
Sources
Last reviewed: 18 October 2026.
