CVE-2025-11004

High

Description

The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of the system that has Simplicity Device Manager tool running in the background.

SeverityHigh

CVSS7.5

Exploit probability—

ProductSimplicity Device Manager

PublishedFeb 10, 2026

First seenFeb 10, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Vendor advisories

community.silabs.com/068Vm00000fjgJj

Affected products

Product	Affected versions	Fixed in
silabs.com Simplicity Device Manager	v ≤ 0.99.35 - alpha	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.