The vulnerability lies in a non‑standard hash function used for secure boot, which is susceptible to second‑preimage attacks. An attacker can create malicious firmware that shares the same hash as a legitimate image, causing the device to accept and run it. This enables the deployment of arbitrary, unauthorized code on the hardware, compromising both the integrity of the system and any data it processes.

Semtech LR1110, LR1120, and LR1121 LoRa transceivers are affected. Firmware versions prior to the latest patch, as identified in the Semtech security bulletin, are vulnerable. No specific release numbers are listed, so all versions should be treated as at risk until a patched firmware is installed.

The CVSS score of 7 indicates a high severity risk, though exploitation requires physical access to the device, limiting the attack surface. The lack of an EPSS score and absence from the KEV catalog mean that known public exploits are not yet documented, but the logical pathway exists for an attacker who can physically interact with the transceiver, making preventive measures essential.