Fragmentation Transport Service Vulnerability in Semtech's LoRaWAN Product

CVE-2026-12363

What is CVE-2026-12363?

The fragmentation transport service in Semtech's LoRaWAN implementation lacks proper validation of the fragment counter in DATA_FRAGMENT commands. This oversight allows an attacker with access to authenticated downlink messages to exploit the flaw, potentially leading to decoder state corruption during firmware updates. Specific details indicate that a frag_counter value of 0 causes an underflow in array indexing, which might corrupt the static decoder object's memory state. Although the vulnerability could impact the firmware update capabilities, mechanisms are in place to mitigate the risk of severe memory corruption or unauthorized code execution. A fix has been implemented to address this issue by introducing a transport-layer check that disallows a frag_counter of 0, enhancing the overall security posture of the affected product.

References