Description
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Semtech | LR1110 Transceiver | unaffected |
|
|||||||||
| Semtech | LR1110 Modem-e | unaffected |
|
|||||||||
| Semtech | LR1120 Transceiver | unaffected |
|
|||||||||
| Semtech | LR1121 Transceiver | unaffected |
|
|||||||||
| Semtech | LR1121 Modem-e | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Mon, 12 Oct 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus. | |
| Title | Out-of-bounds write in LR11xx Transceiver | |
| First Time appeared |
Semtech
Semtech lr1110 Modem-e Semtech lr1110 Transceiver Semtech lr1120 Transceiver Semtech lr1121 Modem-e Semtech lr1121 Transceiver |
|
| Weaknesses | CWE-787 | |
| CPEs | cpe:2.3:a:semtech:lr1110_modem-e:*:*:*:*:*:*:*:* cpe:2.3:a:semtech:lr1110_transceiver:*:*:*:*:*:*:*:* cpe:2.3:a:semtech:lr1110_transceiver:a1_0303:*:*:*:*:*:*:* cpe:2.3:a:semtech:lr1120_transceiver:*:*:*:*:*:*:*:* cpe:2.3:a:semtech:lr1120_transceiver:a2_0101:*:*:*:*:*:*:* cpe:2.3:a:semtech:lr1121_modem-e:*:*:*:*:*:*:*:* cpe:2.3:a:semtech:lr1121_transceiver:*:*:*:*:*:*:*:* cpe:2.3:a:semtech:lr1121_transceiver:a3_0101:*:*:*:*:*:*:* |
|
| Vendors & Products |
Semtech
Semtech lr1110 Modem-e Semtech lr1110 Transceiver Semtech lr1120 Transceiver Semtech lr1121 Modem-e Semtech lr1121 Transceiver |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: Semtech
Published:
Updated: 2026-10-12T17:16:27.538Z
Reserved: 2026-04-13T16:02:12.853Z
Link: CVE-2026-6232
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-787
Out-of-bounds Write