CVE-2025-11004

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-11004

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11004.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-11004

Published

2026-02-10T15:31:30.396Z

Modified

2026-07-15T01:49:12.536307349Z

Severity

7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Reflected XSS vulnerability in Simplicity Device Manager tool

Details

The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of the system that has Simplicity Device Manager tool running in the background.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11004.json",
    "cna_assigner": "Silabs"
}

References

Affected packages

Git / github.com/siliconlabssoftware/simplicity-device-manager

Affected ranges

Type

GIT

Repo

https://github.com/siliconlabssoftware/simplicity-device-manager

Events

Introduced

Last affected

6314e3a8229474088f24f816d989ea2006f727a5

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.99.35 - alpha"
        }
    ]
}

Affected versions

v0.*

v0.99.35-alpha

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11004.json"