CVE-2025-14857
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Semtech LoRa LR11xxx transceivers with early firmware versions have improper access control allowing stack memory writes via the SPI interface. An attacker with physical access can hijack program flow and execute arbitrary code, but changes are lost on reboot.
Risk Assessment
An attacker with physical access can temporarily take control of the device, but cannot permanently modify firmware or obtain cryptographic keys.
Recommendation
Update the LR11xxx transceiver firmware to the latest version.
Original NVD description (English source)
An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.