CVE-2026-6232 (GCVE-0-2026-6232)

Vulnerability from cvelistv5 – Published: 2026-10-12 17:16 – Updated: 2026-10-12 17:16
VLAI
Title
Out-of-bounds write in LR11xx Transceiver
Summary
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.
Severity
5.2 (Medium)
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/RE:M
CWE
Assigner
Semtech CNA under the mitre root
CNA scorecard – unranked: 1 record in the last 180 days, 10 needed details
References
Impacted products
Vendor Product Version CPE status
Semtech LR1110 Transceiver Affected: 0 , < 0x0403 (semver)
Unaffected: A1_0303 (semver)
    cpe:2.3:a:semtech:lr1110_transceiver:*:*:*:*:*:*:*:*
Create a notification for this product.
Semtech LR1110 Modem-e Affected: 0 , < 2.1.1 (semver)
    cpe:2.3:a:semtech:lr1110_modem-e:*:*:*:*:*:*:*:*
Create a notification for this product.
Semtech LR1120 Transceiver Affected: 0 , < 0x0203 (semver)
Unaffected: A2_0101 (semver)
    cpe:2.3:a:semtech:lr1120_transceiver:*:*:*:*:*:*:*:*
Create a notification for this product.
Semtech LR1121 Transceiver Affected: 0 , < 0x0105 (semver)
Unaffected: A3_0101
    cpe:2.3:a:semtech:lr1121_transceiver:*:*:*:*:*:*:*:*
Create a notification for this product.
Semtech LR1121 Modem-e Affected: 0 , < 2.1.1 (semver)
    cpe:2.3:a:semtech:lr1121_modem-e:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Egor (radioegor146) Koleda, https://github.com/radioegor146
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LR1110 Transceiver",
          "vendor": "Semtech",
          "versions": [
            {
              "lessThan": "0x0403",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "A1_0303",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "LR1110 Modem-e",
          "vendor": "Semtech",
          "versions": [
            {
              "lessThan": "2.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "LR1120 Transceiver",
          "vendor": "Semtech",
          "versions": [
            {
              "lessThan": "0x0203",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "A2_0101",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "LR1121 Transceiver",
          "vendor": "Semtech",
          "versions": [
            {
              "lessThan": "0x0105",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "A3_0101"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "LR1121 Modem-e",
          "vendor": "Semtech",
          "versions": [
            {
              "lessThan": "2.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:semtech:lr1110_transceiver:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0x0403",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:semtech:lr1110_transceiver:a1_0303:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:semtech:lr1110_modem-e:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.1.1",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:semtech:lr1120_transceiver:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0x0203",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:semtech:lr1120_transceiver:a2_0101:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:semtech:lr1121_transceiver:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0x0105",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:semtech:lr1121_transceiver:a3_0101:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:semtech:lr1121_modem-e:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.1.1",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egor (radioegor146) Koleda, https://github.com/radioegor146"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An out-of-bounds write vulnerability in the SPI host command interface of Semtech\u0027s LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.\u003cbr\u003e"
            }
          ],
          "value": "An out-of-bounds write vulnerability in the SPI host command interface of Semtech\u0027s LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "PHYSICAL",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/RE:M",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T17:16:27.538Z",
        "orgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e",
        "shortName": "Semtech"
      },
      "references": [
        {
          "url": "https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-002-lr11xx-security-advisory"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds write in LR11xx Transceiver",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e",
    "assignerShortName": "Semtech",
    "cveId": "CVE-2026-6232",
    "datePublished": "2026-10-12T17:16:27.538Z",
    "dateReserved": "2026-04-13T16:02:12.853Z",
    "dateUpdated": "2026-10-12T17:16:27.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-6232",
      "date": "2026-10-13",
      "epss": "0.00167",
      "percentile": "0.05505"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "LR1110 Transceiver",
                "vendor": "Semtech",
                "versions": [
                  {
                    "lessThan": "0x0403",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "A1_0303",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "LR1110 Modem-e",
                "vendor": "Semtech",
                "versions": [
                  {
                    "lessThan": "2.1.1",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "LR1120 Transceiver",
                "vendor": "Semtech",
                "versions": [
                  {
                    "lessThan": "0x0203",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "A2_0101",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "LR1121 Transceiver",
                "vendor": "Semtech",
                "versions": [
                  {
                    "lessThan": "0x0105",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "A3_0101"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "LR1121 Modem-e",
                "vendor": "Semtech",
                "versions": [
                  {
                    "lessThan": "2.1.1",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@sierrawireless.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An out-of-bounds write vulnerability in the SPI host command interface of Semtech\u0027s LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus."
          }
        ],
        "id": "CVE-2026-6232",
        "lastModified": "2026-10-12T18:17:23.333",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "USER",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "PHYSICAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.2,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "source": "security@sierrawireless.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-12T18:17:23.333",
        "references": [
          {
            "source": "security@sierrawireless.com",
            "url": "https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-002-lr11xx-security-advisory"
          }
        ],
        "sourceIdentifier": "security@sierrawireless.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "security@sierrawireless.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.