CVE-2025-40838 Ericsson Indoor Connect 8855 - Insufficiently Protected Credentials Vulnerability
Attackers can bypass client-side security to disclose sensitive information in Ericsson Indoor Connect 8855 devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40838?
CVE-2025-40838 is a medium-severity vulnerability in Ericsson Indoor Connect 8855, published on 25 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disclosure of certain information.
Weakness: CWE-522
Which versions are affected by CVE-2025-40838?
It affects 1 product.
Products include Ericsson Indoor Connect 8855 Firmware.
How do I fix CVE-2025-40838?
No fix has been published for CVE-2025-40838 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-40838 being exploited?
There is no known exploitation of CVE-2025-40838 in the wild and no public exploit code.
Other vulnerabilities in Ericsson Indoor Connect 8855
- CVE-2025-27261 Ericsson Indoor Connect 8855 - Improper Neutralization of Special Elements used in an SQL Command Vulnerability
- CVE-2025-40836 Ericsson Indoor Connect 8855 - Improper Input Validation Vulnerability
- CVE-2025-40837 Ericsson Indoor Connect 8855 - Missing Authorization Vulnerability
- CVE-2025-40842 Ericsson Indoor Connect 8855 - Improper Neutralization of Input During Web Page Generation Vulnerability
- CVE-2025-27262 Ericsson Indoor Connect 8855 - Improper Neutralization of Special Elements used in an OS Command Vulnerability
Sources
Also known as GHSA-9mhv-xfmw-mcmq.