CVE-2025-14857: Semtech LoRa LR11xxx RCE Vulnerability

CVE-2025-14857 Overview

An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution.

Critical Impact

Physical attackers can hijack program control flow via SPI interface to achieve arbitrary code execution, though secure boot prevents persistent compromise and modifications are lost upon reboot.

Affected Products

• Semtech LoRa LR11xxx transceivers (early firmware versions)

Discovery Timeline

• 2026-04-07 - CVE CVE-2025-14857 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2025-14857

Vulnerability Analysis

This vulnerability is classified as CWE-123 (Write-what-where Condition), which occurs when software allows an attacker to write arbitrary values to arbitrary memory locations. In the context of the Semtech LoRa LR11xxx transceivers, the firmware's memory write command exposed through the physical SPI interface lacks proper access control enforcement on the program call stack region.

The vulnerability requires physical access to exploit, meaning an attacker must have direct hardware access to the device's SPI pins. While this limits the attack surface significantly compared to remote vulnerabilities, it presents a serious concern for IoT deployments where devices may be physically accessible in the field.

The security architecture of the LR11xxx transceivers provides several mitigating factors. The secure boot mechanism prevents attackers from installing persistent malicious firmware, the crypto engine maintains isolation of cryptographic keys from direct firmware access, and all malicious modifications are automatically cleared upon device reboot or loss of physical access. This means exploitation yields only temporary, session-based control.

Root Cause

The root cause lies in insufficient access control enforcement within the firmware's SPI command handler. Specifically, the memory write command implementation fails to validate whether the target memory address falls within a protected region, such as the program call stack. This allows direct manipulation of stack memory including return addresses and saved registers.

Attack Vector

The attack requires physical access to the SPI (Serial Peripheral Interface) bus of the target LR11xxx transceiver. An attacker would need to:

1. Gain physical access to the target device
2. Connect to the SPI interface pins on the transceiver
3. Send specially crafted memory write commands targeting stack memory regions
4. Overwrite return addresses or function pointers on the call stack
5. Redirect program execution to attacker-controlled code or gadgets

The attack is constrained by the need for continuous physical access—once the attacker disconnects or the device reboots, all modifications are lost. Additionally, the crypto engine isolation prevents extraction of cryptographic keys even during active exploitation.

Detection Methods for CVE-2025-14857

Indicators of Compromise

• Unusual SPI bus activity or unauthorized physical connections to device interfaces
• Unexpected device behavior or anomalous radio transmissions during operation
• Evidence of physical tampering with device enclosures or protective seals
• Device reboot loops or stability issues that could indicate exploitation attempts

Detection Strategies

• Implement tamper-evident enclosures and physical security monitoring for deployed devices
• Monitor device logs for unexpected reset events or anomalous operational patterns
• Deploy hardware-based intrusion detection on SPI bus lines where feasible
• Conduct periodic physical inspection of devices in accessible locations

Monitoring Recommendations

• Establish baseline behavior profiles for LoRa transceiver operations to detect anomalies
• Implement network-level monitoring for unusual transmission patterns from affected devices
• Configure centralized logging for device health and status messages
• Consider deploying hardware security modules to detect unauthorized SPI access

How to Mitigate CVE-2025-14857

Immediate Actions Required

• Update affected Semtech LoRa LR11xxx transceiver firmware to the latest patched version
• Review physical security controls for deployed devices and enhance where necessary
• Conduct inventory assessment to identify all devices running vulnerable firmware versions
• Implement tamper-resistant enclosures for devices in publicly accessible locations

Patch Information

Semtech has released a security bulletin addressing this vulnerability. Organizations should consult the Semtech Security Bulletin PSA-2026-001 for detailed patching instructions and updated firmware versions.

Workarounds

• Deploy devices in physically secured locations with access controls and monitoring
• Implement tamper-evident seals on device enclosures to detect unauthorized access
• Consider adding epoxy or conformal coating over SPI interface pins to prevent probing
• Establish regular physical inspection schedules for devices in field deployments
• Implement defense-in-depth by not relying solely on device-level security for sensitive operations