PT-2026-110823 · Semtech · Lr1110 Modem-E+4
CVE-2026-6232
·
Published
2026-10-12
·
Updated
2026-10-12
CVSS v4.0
5.2
Medium
| Vector | AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/RE:M |
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lr1110 Modem-E
Lr1110 Transceiver
Lr1120 Transceiver
Lr1121 Modem-E
Lr1121 Transceiver