CVE-2025-14859
Second Preimage Attack on Semtech LR11xx Secure Boot Enables Firmware Tampering
Publication date: 2026-04-07
Last updated on: 2026-04-07
Assigner: Sierra Wireless Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| semtech | lr11xx | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Semtech LR11xx LoRa transceivers use secure boot functionality that relies on digital signatures to authenticate firmware. However, the cryptographic hashing algorithm used in this process is non-standard and vulnerable to second preimage attacks. This means an attacker with physical access to the device can create a malicious firmware image that produces the same hash as a legitimate one, bypassing the secure boot verification and allowing unauthorized firmware to be installed.
How can this vulnerability impact me? :
This vulnerability allows an attacker with physical access to the affected Semtech LoRa transceivers to bypass secure boot protections and install arbitrary, unauthorized firmware on the device. This could lead to compromised device integrity, unauthorized control, and potential disruption or manipulation of device functions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability requires physical access to the affected Semtech LR11xx LoRa transceivers to exploit the weakness in the secure boot implementation. There is no indication that it can be detected remotely on a network or system.
No specific detection commands or network-based detection methods are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Since the vulnerability requires physical access to the device, immediate mitigation steps include restricting physical access to the affected devices to trusted personnel only.
Additionally, monitoring and controlling device firmware updates to ensure only authenticated and verified firmware is installed can help mitigate the risk.
Refer to Semtech's security bulletin SEM-PSA-2026-001 for any available patches or updated firmware addressing this vulnerability.