CVE-2025-11004CWE-79

Reflected XSS vulnerability in Simplicity Device Manager tool

High · published February 10, 2026

CVSS v4.0
7.5
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of the system that has Simplicity Device Manager tool running in the background.

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-10T15:31Z
EPSS history
Timeline
  • 10 FEB 15:31Z
    Reflected XSS vulnerability in Simplicity Device Manager tool
    cvelistv5