CVE-2025-14859

Katalog CVE

CVSS 7.0 · High EPSS 0,11%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm. Skor CVSS 4.0 7.0 (High) menurut sierrawireless.com.

Deskripsi (NVD)

The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a non-standard cryptographic hashing algorithm that is vulnerable to second preimage attacks. An attacker with physical access to the device can exploit this weakness to generate a malicious firmware image with a hash collision, bypassing the secure boot verification mechanism and installing arbitrary unauthorized firmware on the device.

Rincian

Terbit di NVD

7 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Awaiting Analysis

CVSS 4.0

7.0 (High), sumber sierrawireless.com
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:I/V:C/RE:M/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,11% peluang dieksploitasi; lebih tinggi dari 1,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001