Semtech LR11xx LoRa Transceivers Secure Boot Vulnerability Allowing Unauthorized Firmware Installation

A vulnerability exists in the Semtech LR11xx LoRa transceivers due to the use of a non-standard cryptographic hashing algorithm in the secure boot process. This algorithm is susceptible to second preimage attacks, allowing an attacker with physical access to the device to create a malicious firmware image that collides with the hash of a legitimate one. By exploiting this flaw, the attacker can bypass the secure boot verification and install unauthorized firmware on the device.

Impact

Exploitation of this vulnerability allows for the installation of arbitrary, unauthorized firmware on the affected device, potentially leading to unauthorized control or functionality.