CVE-2025-27260
Published: 25 March 2026
Summary
CVE-2025-27260 is a high-severity Improper Filtering of Special Elements (CWE-790) vulnerability in Ericsson Indoor Connect 8855 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation directly addresses this specific improper filtering vulnerability by applying vendor patches to prevent unauthorized information modification.
Information input validation comprehensively mitigates improper filtering of special elements by enforcing checks at input interfaces to block exploitation leading to data modification.
Software, firmware, and information integrity verification detects unauthorized modifications resulting from exploitation of the filtering vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated network exploit of public-facing app (T1190) directly enables unauthorized data modification (T1565).
NVD Description
Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if exploited, can lead to unauthorized modification of certain information
Deeper analysisAI
CVE-2025-27260 is an Improper Filtering of Special Elements vulnerability (CWE-790) in Ericsson Indoor Connect 8855 versions prior to 2025.Q3. Published on 2026-03-25, it enables unauthorized modification of certain information if exploited. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), reflecting high severity driven by network accessibility, low attack complexity, no required privileges or user interaction, and high integrity impact without affecting confidentiality or availability.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation allows the attacker to modify certain information without authorization, potentially compromising the integrity of the affected Indoor Connect 8855 system.
Ericsson has issued advisories on the vulnerability, including details at https://www.ericsson.com/en/about-us/security/psirt/CVE-2025-27260 and a security bulletin for Indoor Connect at https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-indoorconnect-march-2026. Security practitioners should consult these resources for recommended mitigations and patching instructions.
Details
- CWE(s)