CVE-2025-14859 — Semtech LR11xx Secure Boot Bypass

Description (CNA)

The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a non-standard cryptographic hashing algorithm that is vulnerable to second preimage attacks. An attacker with physical access to the device can exploit this weakness to generate a malicious firmware image with a hash collision, bypassing the secure boot verification mechanism and installing arbitrary unauthorized firmware on the device.

Affected (CNA)

Vendor / product	Versions
Semtech / LR1110	affected 0 before BL2 FW 0x1001
Semtech / LR1120	affected 0 before BL2 FW 0x2001
Semtech / LR1121	affected 0 before BL2 FW 0x2101

CWE

CWE-327

References

https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.