CVE-2025-10285 Simplcity Device Manager exposes NTLMv2 hash

HighCVSS 7.4 EPSS 0.19%

Published: 2025-12-04 23:36
Updated: 2026-10-18 18:10
Exploit status: No public exploit known

Description

The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password.

Affected products

Product	Affected versions	Fixed in
silabs.com Simplicity Studio V6	< 0.100.18	0.100.18

References

community.silabs.com permissions-required vendor-advisory

CVSS v4.0

7.4 High

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Attack Vector: Adjacent
Attack Complexity: Low
Attack Requirements: Present
Privileges Required: None
User Interaction: Passive
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: None
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 7.4 · silabs
v4.0 7.4 · product-security@silabs.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.19% (percentile 8.3)
CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.