# CVE-2025-14859: Semtech LR11xx secure boot bypass via cryptographic hash collision

Source: https://junglewise.ai/threats/cve-2025-14859-semtech-lr11xx-secure-boot-bypass-via-cryptographic-hash  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2025-14859 · Severity: info · CVSS 7 · Published 2026-04-07

Semtech LR11xx transceivers, which are chips used for long-range wireless communication in IoT devices, contain a flaw in how they verify software updates. An attacker with physical access to the hardware could bypass security checks to install and run unauthorized software. This could lead to a total loss of device integrity, allowing the attacker to control the device's operations or steal sensitive data.

Technologies: [Semtech LR1110](https://junglewise.ai/threats/technologies/lr1110), [Semtech LR1120](https://junglewise.ai/threats/technologies/lr1120), [Semtech LR1121](https://junglewise.ai/threats/technologies/lr1121). Vendors: [Semtech](https://junglewise.ai/threats/vendors/semtech).

## Quick answers

**Is CVE-2025-14859 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14859 being exploited in the wild.

**How severe is CVE-2025-14859?** Informational severity, with a CVSS score of 7, published 7 April 2026.

**Which products and versions are affected?** Semtech LR1110 Before BL2 FW 0x1001; Semtech LR1120 Before BL2 FW 0x2001; Semtech LR1121 Before BL2 FW 0x2101.

**Is there a fix for CVE-2025-14859?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-14859 attacked?** It is attacked with physical access, in device firmware.

**Am I affected by CVE-2025-14859?** Check whether you run Semtech LR1110, Semtech LR1120 or Semtech LR1121 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Semtech LR11xx LoRa transceivers (LR1110, LR1120, LR1121) utilize a non-standard cryptographic hashing algorithm within their secure boot process. This algorithm is vulnerable to second preimage attacks, allowing an attacker to create a malicious firmware image that produces the same hash as a legitimate, signed image. Exploitation requires physical access to the device to load the malicious firmware. Successful exploitation bypasses digital signature verification, enabling the execution of arbitrary unauthorized code. The issue is addressed in updated bootloader (BL2) firmware versions.

## Affected products

- Semtech LR1110 Before BL2 FW 0x1001
- Semtech LR1120 Before BL2 FW 0x2001
- Semtech LR1121 Before BL2 FW 0x2101

## Timeline

- 2026-04-07: disclosed
- 2026-04-07: advisory

## References

- [https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001](https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001)

## Related threats

- [Semtech LR11xx information disclosure in firmware validation](https://junglewise.ai/threats/cve-2025-14858-semtech-lr11xx-information-disclosure-in-firmware-validation)
- [Semtech LoRa LR11xxx improper access control in SPI memory write](https://junglewise.ai/threats/cve-2025-14857-semtech-lora-lr11xxx-improper-access-control-in-spi-memory-write)