What’s Vulnerable › Vulnerabilities
CVE-2025-14859: Semtech LR11xx Secure Boot Bypass
- Severity: high (CVSS 7.0 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-07 · updated 2026-07-24
- Weakness: CWE-327
Description
The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a non-standard cryptographic hashing algorithm that is vulnerable to second preimage attacks. An attacker with physical access to the device can exploit this weakness to generate a malicious firmware image with a hash collision, bypassing the secure boot verification mechanism and installing arbitrary unauthorized firmware on the device.
Affected products
- Semtech LR1110: before BL2 FW 0x1001 — fixed in BL2 FW 0x1001
- Semtech LR1120: before BL2 FW 0x2001 — fixed in BL2 FW 0x2001
- Semtech LR1121: before BL2 FW 0x2101 — fixed in BL2 FW 0x2101
How to fix
Upgrade to a fixed version: Semtech LR1110 BL2 FW 0x1001; Semtech LR1120 BL2 FW 0x2001; Semtech LR1121 BL2 FW 0x2101. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-14859 or the next vulnerability affects your stack