{"id":"CVE-2025-27262","aliases":["EUVD-2025-31101","GHSA-qwqv-9p6m-xpc9"],"status":"published","title":"Ericsson Indoor Connect 8855 -  Improper Neutralization of Special Elements used in an OS Command Vulnerability","description":"Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00579,"percentile":0.47946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2025-09-25T14:43:29Z","modified":"2026-10-11T20:10:00Z","products":[{"vendor":"ericsson","product":"indoor connect 8855"},{"vendor":"ericsson","product":"indoor_connect_8855_firmware"}],"references":[{"url":"https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27262"},{"url":"https://github.com/advisories/GHSA-qwqv-9p6m-xpc9"}],"sources":{"cve":[{"id":"CVE-2025-27262","title":"Ericsson Indoor Connect 8855 -  Improper Neutralization of Special Elements used in an OS Command Vulnerability","description":"Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges.","status":"published","published":"2025-09-25T14:43:29.803Z","modified":"2025-09-30T12:13:16.746Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-31101","description":"Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges.","status":"published","published":"2025-09-25T14:43:29Z","modified":"2025-09-30T12:13:16Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T20:31:38.096877Z"}],"ghsa":[{"id":"GHSA-qwqv-9p6m-xpc9","title":"Ericsson\nIndoor Connect 8855 contains a command injection vulnerability which if\nexploited can...","description":"Ericsson\nIndoor Connect 8855 contains a command injection vulnerability which if\nexploited can lead to loss of integrity and confidentiality, as well as\nunauthorized disclosure and modification of user and configuration data. It\nmay also be possible to execute commands with escalated privileges, impact\nservice availability, as well as modify system files and configuration\ndata.","status":"published","published":"2025-09-25T15:30:24Z","modified":"2025-10-02T18:30:58Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:03:50.19975Z"}],"nvd":[{"id":"CVE-2025-27262","description":"Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges.","status":"published","published":"2025-09-25T15:16:10.737Z","modified":"2026-10-11T20:10:00.2Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:32.559087Z"}]}}