CVE-2025-40837

HighCVSS 8.8/10Last modified Oct 11, 2026

Description

Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges than intended.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 25, 2025
Last modified
Oct 11, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-408387.5Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead tCVE-2025-40845.7Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this commandCVE-2025-408414.3Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Request Forgery (CSRF) vulnerability which, if exploited, can lCVE-2025-408426.1Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Scripting (XSS) vulnerability which, if exploited, can lead to CVE-2025-408437.8CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. CodeChecker versCVE-2025-408467.1Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirecCVE-2025-40857.1An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escaCVE-2025-40866.5A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in thCVE-2025-40874.8A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribuCVE-2025-40886.5A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on anyCVE-2025-408856.5A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authentCVE-2025-408868.8A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated u
CVE-2025-40837: High severity, CVSS 8.8 | Vulnix