CVE-2025-11571
Command Execution vulnerability in Simplicity Installer
- State
- Published
- Severity
- 2.1 Low
- Published
- Mar 24, 2026
- Updated
- Mar 24, 2026
- Reserved
- Oct 9, 2025
Description
Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to execute can open executables. However, the commands cannot pass parameters or arguments. To successfully execute this attack, the attacker needs to be on the same network.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.1 Low | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | Silabs |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
Simplicity Studio v5silabs.com |
|
Simplicity Installer tool (Silicon Labs Tool - SLT) for Simplicity Studio v6silabs.com |
|
References
- https://community.silabs.com/068Vm00000htltZpermissions-requiredvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.