Quick answers
- Is CVE-2025-14859 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-14859 being exploited in the wild.
- How severe is CVE-2025-14859?
- Informational severity, with a CVSS score of 7, published 7 April 2026.
- Which products and versions are affected?
- Semtech LR1110 Before BL2 FW 0x1001; Semtech LR1120 Before BL2 FW 0x2001; Semtech LR1121 Before BL2 FW 0x2101.
- Is there a fix for CVE-2025-14859?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-14859 attacked?
- It is attacked with physical access, in device firmware.
- Am I affected by CVE-2025-14859?
- Check whether you run Semtech LR1110, Semtech LR1120 or Semtech LR1121 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Semtech LR11xx LoRa transceivers (LR1110, LR1120, LR1121) utilize a non-standard cryptographic hashing algorithm within their secure boot process. This algorithm is vulnerable to second preimage attacks, allowing an attacker to create a malicious firmware image that produces the same hash as a legitimate, signed image. Exploitation requires physical access to the device to load the malicious firmware. Successful exploitation bypasses digital signature verification, enabling the execution of arbitrary unauthorized code. The issue is addressed in updated bootloader (BL2) firmware versions.
Affected products
- Semtech LR1110 Before BL2 FW 0x1001
- Semtech LR1120 Before BL2 FW 0x2001
- Semtech LR1121 Before BL2 FW 0x2101
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory