The vulnerability is an improper neutralization of input during web page generation in Ericsson Indoor Connect 8855 versions released before 2025.Q3. It allows an attacker to inject malicious scripts into pages served by the device, enabling theft or alteration of data visible to a web‑browser user. This client‑side input sanitization flaw is a classic Reflected Cross‑Site Scripting weakness (CWE‑79).

All units of Ericsson Indoor Connect 8855 that run firmware dated prior to the 2025.Q3 release are impacted. This includes the hardware platform that hosts the indoor positioning software as well as the firmware that provides the web interface for configuration and monitoring.

The flaw scores a high CVSS score of 8.5, yet the EPSS score is below 1 %, indicating that while the potential impact is severe, current exploitation risk is low. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an attacker crafting a malicious URL or payload that is passed through the device’s web interface, which a victim’s browser then renders. Such an attack would require an authenticated or unauthenticated user to view the affected web page but no further system compromise is required.