CVE-2025-14859 - CVE House
Back to Database
Status published High CVE-2025-14859

Semtech LR11xx Secure Boot Bypass

Vulnerability Description

The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a non-standard cryptographic hashing algorithm that is vulnerable to second preimage attacks. An attacker with physical access to the device can exploit this weakness to generate a malicious firmware image with a hash collision, bypassing the secure boot verification mechanism and installing arbitrary unauthorized firmware on the device.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14859

Credits & Attribution

No credits recorded in the NVD database.

Affected Vendor

Affected Software

LR1110, LR1120, LR1121
Vulnerable Versions:
0

Timeline

Official Publish: April 7th, 2026
Last Modified: April 7th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)