Information Disclosure Vulnerability in Semtech LR11xx LoRa Transceivers

CVE-2025-14858

What is CVE-2025-14858?

The Semtech LR11xx LoRa transceivers have a vulnerability stemming from how their firmware validation functionality is implemented. Specifically, when the device receives a firmware validity check command through the SPI interface, it decrypts the firmware package block by block to ensure integrity. However, a significant oversight occurs as the final decrypted block remains in memory, unremoved, once the validation concludes. This residual data can be exploited by an attacker with physical access to the SPI interface, permitting unauthorized retrieval of the unprotected firmware data through memory read commands, thereby circumventing the intended encryption protections.

References