Lr1110 EUVD-2025-209287

Real-world risk is constrained but non-negligible for targeted attacks on high-value IoT deployments. CVSS 7.0 reflects high confidentiality/integrity impact (VC:H/VI:H) but requires physical proximity (AV:P), creating a threat model limited to supply chain tampering, insider threats, or physical device compromise in unattended installations (smart city sensors, industrial IoT). Attack complexity is low (AC:L) with no privilege requirements (PR:N), meaning any attacker with device access can exploit this. The vulnerability is not automatable at scale due to physical access requirements, reducing mass exploitation risk. No CISA KEV listing or public exploit code exists, and SSVC likely categorizes this as 'attended' deployment context with 'efficient' technical impact. However, for critical infrastructure IoT (energy grids, water systems) or devices processing sensitive telemetry, the inability to trust firmware provenance poses significant long-term supply chain risk. Organizations using LR11xx in tamper-evident enclosures or physically secured environments face lower practical risk than those with field-deployed, accessible devices.

An attacker intercepts LR1120-based asset trackers during shipping or gains temporary physical access to unattended smart agriculture sensors in a field deployment. Using publicly disclosed details of the non-standard hash algorithm, the attacker precomputes hash collisions offline, generating malicious firmware that matches the hash of legitimate signed firmware. They connect to the device's debug/programming interface, flash the malicious firmware, and the secure boot mechanism validates the forged signature, installing backdoored code. The compromised firmware exfiltrates sensor data, manipulates telemetry readings, or provides persistent remote access to the LoRaWAN network, with no runtime indication of compromise since secure boot validation succeeded.