CVE-2025-11004

HIGH EPSS 17.0%

Published Feb 10, 20264mo ago · Modified Jun 17, 20262w ago

7.5 CVSS 4.0

High

Published Feb 10, 2026 4mo ago

Last Modified Jun 17, 2026 2w ago

Description

The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of the system that has Simplicity Device Manager tool running in the background.

CVSS Details

Base Score

7.5

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction A

Scope X

Threat Intelligence

EPSS Exploit Probability

17.0% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

References 1

community.silabs.com https://community.silabs.com/068Vm00000fjgJj

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.