Vulnerability · Published Feb 10, 2026 · Assigned by Silabs

CVE-2025-11004Reflected XSS vulnerability in Simplicity Device Manager tool

High 7.5

In plain English

A high-severity cross-site scripting in Simplicity Device Manager from silabs.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.3%top 76.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of the system that has Simplicity Device Manager tool running in the background.

Affected products (as reported)

Vendor	Product	Versions
silabs.com	Simplicity Device Manager	0 – through 0.99.35 - alpha

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://community.silabs.com/068Vm00000fjgJj vendor-advisory, permissions-required