CVE-2025-14857

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14857", "assignerOrgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e", "state": "PUBLISHED", "assignerShortName": "SWI", "dateReserved": "2025-12-18T00:09:25.318Z", "datePublished": "2026-04-07T19:56:59.042Z", "dateUpdated": "2026-04-07T20:42:41.466Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e", "shortName": "SWI", "dateUpdated": "2026-04-07T19:56:59.042Z"}, "title": "Semtech LR11xx Memory Write Access Control Bypass", "datePublic": "2026-04-06T18:07:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-123", "description": "CWE-123 Write-what-where Condition", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-679", "descriptions": [{"lang": "en", "value": "CAPEC-679 Exploitation of Improperly Configured or Implemented Memory Protections"}]}], "affected": [{"vendor": "Semtech", "product": "LR1110", "modules": ["firmware"], "versions": [{"status": "affected", "version": "0", "lessThan": "TRX FW 0x0402", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Semtech", "product": "LR1120", "versions": [{"status": "affected", "version": "0", "lessThan": "TRX FW 0x0202", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Semtech", "product": "LR1121", "versions": [{"status": "affected", "version": "0", "lessThan": "TRX FW 0x0104", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:semtech:lr1110:*:*:*:*:*:*:*:*", "versionEndExcluding": "trx_fw_0x0402", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:semtech:lr1120:*:*:*:*:*:*:*:*", "versionEndExcluding": "trx_fw_0x0202", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:semtech:lr1121:*:*:*:*:*:*:*:*", "versionEndExcluding": "trx_fw_0x0104", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "value": "An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.<br>"}]}], "references": [{"url": "https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "PHYSICAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "AUTOMATIC", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/AU:N/R:A/V:D/RE:M"}}], "credits": [{"lang": "en", "value": "Egor (radioegor146) Koleda, https://github.com/radioegor146", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14857", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T20:31:21.612362Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T20:42:41.466Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14857", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T20:31:21.612362Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T20:38:09.550Z"}}], "cna": {"title": "Semtech LR11xx Memory Write Access Control Bypass", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Egor (radioegor146) Koleda, https://github.com/radioegor146"}], "impacts": [{"capecId": "CAPEC-679", "descriptions": [{"lang": "en", "value": "CAPEC-679 Exploitation of Improperly Configured or Implemented Memory Protections"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 5.4, "Automatable": "NO", "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/AU:N/R:A/V:D/RE:M", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Semtech", "modules": ["firmware"], "product": "LR1110", "versions": [{"status": "affected", "version": "0", "lessThan": "TRX FW 0x0402", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Semtech", "product": "LR1120", "versions": [{"status": "affected", "version": "0", "lessThan": "TRX FW 0x0202", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Semtech", "product": "LR1121", "versions": [{"status": "affected", "version": "0", "lessThan": "TRX FW 0x0104", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-06T18:07:00.000Z", "references": [{"url": "https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.", "supportingMedia": [{"type": "text/html", "value": "An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-123", "description": "CWE-123 Write-what-where Condition"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:semtech:lr1110:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "trx_fw_0x0402", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:semtech:lr1120:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "trx_fw_0x0202", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:semtech:lr1121:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "trx_fw_0x0104", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e", "shortName": "SWI", "dateUpdated": "2026-04-07T19:56:59.042Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14857", "state": "PUBLISHED", "dateUpdated": "2026-04-07T20:42:41.466Z", "dateReserved": "2025-12-18T00:09:25.318Z", "assignerOrgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e", "datePublished": "2026-04-07T19:56:59.042Z", "assignerShortName": "SWI"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["firmware"], "product": "LR1110", "vendor": "Semtech", "versions": [{"lessThan": "TRX FW 0x0402", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "LR1120", "vendor": "Semtech", "versions": [{"lessThan": "TRX FW 0x0202", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "LR1121", "vendor": "Semtech", "versions": [{"lessThan": "TRX FW 0x0104", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@sierrawireless.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso inadecuado existe en los transceptores Semtech LoRa LR11xxx que ejecutan versiones tempranas de firmware donde el comando de escritura de memoria accesible a trav\u00e9s de la interfaz SPI f\u00edsica no logra aplicar la protecci\u00f3n contra escritura en la pila de llamadas del programa. Un atacante con acceso f\u00edsico a la interfaz SPI puede sobrescribir la memoria de la pila para secuestrar el flujo de control del programa y lograr una ejecuci\u00f3n de c\u00f3digo arbitrario limitada. Sin embargo, el impacto se limita a la sesi\u00f3n de ataque activa: el mecanismo de arranque seguro del dispositivo evita la modificaci\u00f3n persistente del firmware, el motor criptogr\u00e1fico a\u00edsla las claves criptogr\u00e1ficas del acceso directo al firmware, y todas las modificaciones se pierden al reiniciar el dispositivo o al perder el acceso f\u00edsico."}], "id": "CVE-2025-14857", "lastModified": "2026-07-24T23:10:00.563", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "security@sierrawireless.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14857", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T20:31:21.612362Z", "version": "2.0.3"}}]}, "published": "2026-04-07T20:16:21.253", "references": [{"source": "security@sierrawireless.com", "url": "https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001"}], "sourceIdentifier": "security@sierrawireless.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-123"}], "source": "security@sierrawireless.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,TRX FW 0x0402)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LR1110", "source": "cna", "vendor": "Semtech"}, "product": "lr1110", "vendor": "semtech"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,TRX FW 0x0202)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LR1120", "source": "cna", "vendor": "Semtech"}, "product": "lr1120", "vendor": "semtech"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,TRX FW 0x0104)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LR1121", "source": "cna", "vendor": "Semtech"}, "product": "lr1121", "vendor": "semtech"}], "analysis": {"en": {"generated_at": "2026-04-07T21:20:52.559320+00:00", "value": {"mitigation_remediation": ["Apply the latest Semtech firmware update", "Restrict or disable physical SPI access when possible", "Monitor device for abnormal activity and enforce secure boot"], "summary": {"action": "Update Firmware", "impact": "Physical Access Arbitrary Code Execution"}, "threat_synthesis": {"affected_systems": "The flaw affects Semtech LR1110, LR1120, and LR1121 transceivers running early firmware releases that do not enforce stack write protection. The exact firmware versions are not listed, but the issue applies to the initial firmware versions before the fix was implemented.", "description_and_impact": "An improper access control flaw in Semtech LoRa transceivers allows anyone with physical access to the SPI interface to issue memory write commands that bypass write protection on the program call stack. This vulnerability can be exploited to overwrite stack memory, redirect program flow, and execute limited arbitrary code during the active session. However, the device's secure boot and crypto engine prevent persistent firmware changes, and any modifications are lost when the device reboots or physical access is removed.", "risk_and_exploitability": "The CVSS score is 5.4, indicating moderate severity. No EPSS score is available, and the vulnerability is not catalogued in CISA's KEV list. Exploitation requires direct physical access to the SPI bus, limiting the attack scope. Once exploited, the attacker can hijack program control flow but cannot make persistent changes due to secure boot enforcement and cryptographic key isolation."}}}}, "created": "2026-04-08T19:34:28.664547+00:00", "updated": "2026-04-08T19:45:57.620582+00:00", "vendors": ["semtech", "semtech$PRODUCT$lr1110", "semtech$PRODUCT$lr1120", "semtech$PRODUCT$lr1121"]}