CVE-2025-10285: Simplcity Device Manager exposes NTLMv2 hash
The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10285?
CVE-2025-10285 is considered to have a high severity due to the potential for attackers to extract NTLMv2 hashes.
How do I fix CVE-2025-10285?
To fix CVE-2025-10285, restrict access to the web interface of the Silicon Labs Simplicity Device Manager to trusted IP addresses only.
What vulnerabilities are introduced by CVE-2025-10285?
CVE-2025-10285 introduces vulnerabilities allowing unauthorized access to sensitive user credential information.
Who is affected by CVE-2025-10285?
Users of the Silicon Labs Simplicity Device Manager are affected by CVE-2025-10285 if the web interface is exposed publicly.
What type of attack can CVE-2025-10285 facilitate?
CVE-2025-10285 can facilitate credential harvesting attacks by allowing attackers to extract NTLMv2 hashes.