CVE-2025-14859

The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a non-standard cryptographic hashing algorithm that is vulnerable to second preimage attacks. An attacker with physical access to the device can exploit this weakness to generate a malicious firmware image with a hash collision, bypassing the secure boot verification mechanism and installing arbitrary unauthorized firmware on the device.

• CWE-327

• https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001

Published

Apr 7, 2026

Last Modified

Jul 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14853The LEAV Last Email Address Validator plugin for WordPress i…4.3
• CVE-2025-14854The WP-CRM System plugin for WordPress is vulnerable to unau…5.4
• CVE-2025-14855The SureForms plugin for WordPress is vulnerable to Stored C…7.2
• CVE-2025-14856A security vulnerability has been detected in y_project RuoY…8.8
• CVE-2025-14857An improper access control vulnerability exists in Semtech L…5.4
• CVE-2025-14858The Semtech LR11xx LoRa transceivers running early versions …5.1
• CVE-2025-1486The WoWPth WordPress plugin through 2.0 does not sanitise an…7.1
• CVE-2025-14860Use-after-free in the Disability Access APIs component. This…9.8
• CVE-2025-14861Memory safety bugs present in Firefox 146. Some of these bug…8.8
• CVE-2025-14864The Virusdie - One-click website security plugin for WordPre…4.3
• CVE-2025-14865The Passster – Password Protect Pages and Content plugin for…6.4
• CVE-2025-14866The Melapress Role Editor plugin for WordPress is vulnerable…8.8