CVE-2025-14859 Semtech CVE debrief

Who should care

Organizations using Semtech LR11xx LoRa transceivers in their IoT devices should prioritize patching this vulnerability to prevent potential attacks. The vulnerability's high CVSS score of 7 indicates a significant risk to device security.

Technical summary

The Semtech LR11xx LoRa transceivers use a non-standard cryptographic hashing algorithm for secure boot, which is vulnerable to second preimage attacks. This allows an attacker with physical access to create a malicious firmware image with a hash collision, bypassing secure boot verification and enabling the installation of unauthorized firmware. Affected product deployments should be identified and prioritized for patching, considering the high CVSS score of 7 and potential impact on device security. The vulnerability's exploitation requires physical access to the device, but successful attacks could lead to unauthorized firmware installations, emphasizing the need for prompt patching and monitoring of suspicious firmware updates.

Defensive priority

High priority should be given to patching affected devices, as the vulnerability allows for the installation of arbitrary firmware. Organizations should also consider implementing compensating controls, such as monitoring for suspicious firmware updates and ensuring physical security of devices.

Recommended defensive actions

• Apply patches or updates provided by the vendor to fix the vulnerable hashing algorithm
• Implement monitoring for suspicious firmware updates and ensure physical security of devices
• Consider using alternative secure boot mechanisms that utilize standard cryptographic hashing algorithms
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, but further analysis is needed to fully understand the impact and potential mitigations. The Semtech security bulletin (SEM-PSA-2026-001) likely contains additional details on patching and mitigation strategies.

Official resources