Vulnerability · Published Apr 7, 2026 · Assigned by SWI

CVE-2025-14859Semtech LR11xx Secure Boot Bypass

High 7.0

In plain English

A high-severity broken cryptography in LR1110 from Semtech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.1%top 98.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a non-standard cryptographic hashing algorithm that is vulnerable to second preimage attacks. An attacker with physical access to the device can exploit this weakness to generate a malicious firmware image with a hash collision, bypassing the secure boot verification mechanism and installing arbitrary unauthorized firmware on the device.

Affected products (as reported)

Vendor	Product	Versions
Semtech	LR1110	0 – before BL2 FW 0x1001
Semtech	LR1120	0 – before BL2 FW 0x2001
Semtech	LR1121	0 – before BL2 FW 0x2101

Weakness: CWE-327 · Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/AU:N/R:I/V:C/RE:M

References

https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001