Vulnerability · Published Mar 24, 2026 · Assigned by Silabs

CVE-2025-11571Command Execution vulnerability in Simplicity Installer

Low 2.1

In plain English

A low-severity OS command injection in Simplicity Installer tool (Silicon Labs Tool - SLT) for Simplicity Studio v6 from silabs.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.4%top 63.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to execute can open executables. However, the commands cannot pass parameters or arguments. To successfully execute this attack, the attacker needs to be on the same network.

Affected products (as reported)

Vendor	Product	Versions
silabs.com	Simplicity Studio v5	0 – through 5.11.2.1
silabs.com	Simplicity Installer tool (Silicon Labs Tool - SLT) for Simplicity Studio v6	0 – through 1.0.1

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://community.silabs.com/068Vm00000htltZ permissions-required, vendor-advisory