Semtech vulnerabilities

Products

• lora basics station 1
• loramac-node 1
• LR1110 Modem-e 1
• LR1110 Transceiver 1
• LR1120 Transceiver 1
• LR1121 Modem-e 1
• LR1121 Transceiver 1

Latest Semtech CVEs

Newest publication first

1. CVE-2026-6232 Out-of-bounds write in LR11xx Transceiver

   Published 2026-10-12

   Medium·CVSS 5.2

   An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent...

2. CVE-2020-11068 In LoRaMac-node before 4.4.4, a reception buffer overflow can happen due to the received buffer size not being checked. This has been fixed in 4.4.4.

   Published 2020-06-23

   High·CVSS 8.8

   In LoRaMac-node before 4.4.4, a reception buffer overflow can happen due to the received buffer size not being checked. This has been fixed in 4.4.4.

3. CVE-2020-4060 In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message (htt...

   Published 2020-06-22

   Medium·CVSS 5.0

   In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message (https://doc.sm.tc/station/cupsproto.html#http-post-response) where the signature le...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.