What’s Vulnerable › Vulnerabilities
CVE-2025-14857: Semtech LR11xx Memory Write Access Control Bypass
- Severity: medium (CVSS 5.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-07 · updated 2026-07-24
- Weakness: CWE-123
Description
An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.
Affected products
- Semtech LR1110: before TRX FW 0x0402 — fixed in TRX FW 0x0402
- Semtech LR1120: before TRX FW 0x0202 — fixed in TRX FW 0x0202
- Semtech LR1121: before TRX FW 0x0104 — fixed in TRX FW 0x0104
How to fix
Upgrade to a fixed version: Semtech LR1110 TRX FW 0x0402; Semtech LR1120 TRX FW 0x0202; Semtech LR1121 TRX FW 0x0104. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-14857 or the next vulnerability affects your stack