CVE-2025-14858: Semtech LR11xx Information Disclosure Flaw

CVE-2025-14858 Overview

CVE-2025-14858 is an information disclosure vulnerability affecting Semtech LR11xx LoRa transceivers running early versions of firmware. The vulnerability exists in the device's firmware validation functionality, where the last decrypted firmware block remains uncleared in memory after the validation process completes. An attacker with physical access to the device's SPI interface can exploit this residual memory to retrieve decrypted firmware contents, effectively bypassing the firmware encryption protection mechanism.

Critical Impact

Physical attackers with SPI interface access can bypass firmware encryption protections and extract decrypted firmware contents from residual memory, potentially exposing proprietary firmware code and intellectual property.

Affected Products

• Semtech LR11xx LoRa transceivers (early firmware versions)

Discovery Timeline

• 2026-04-07 - CVE-2025-14858 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2025-14858

Vulnerability Analysis

This vulnerability falls under CWE-226 (Sensitive Information in Resource Not Removed Before Reuse). The Semtech LR11xx LoRa transceivers implement a firmware validation mechanism that decrypts firmware packages block-by-block when a host issues a firmware validity check command via the SPI interface. The core issue is that after the validation process completes, the device fails to clear the last decrypted firmware block from memory.

This improper memory sanitization creates a window for information disclosure. The decrypted firmware data persists in accessible memory regions, allowing subsequent memory read operations to extract sensitive firmware contents that should remain encrypted and protected.

Root Cause

The root cause is improper memory management during the firmware validation process. When the LR11xx device performs block-by-block decryption to validate firmware integrity, it utilizes a memory buffer for each decrypted block. Upon completion of the validation routine, the device fails to implement proper memory sanitization—specifically, it does not zero out or otherwise clear the buffer containing the last decrypted firmware block. This sensitive data remains in memory and is accessible through standard SPI memory read commands.

Attack Vector

The attack requires physical access to the device's SPI (Serial Peripheral Interface) interface. An attacker must:

1. Gain physical access to the target Semtech LR11xx LoRa transceiver
2. Connect to the device's SPI interface using appropriate hardware
3. Issue a firmware validity check command with an encrypted firmware package
4. Wait for the validation process to complete
5. Issue SPI memory read commands to retrieve the residual decrypted firmware block from memory

The physical access requirement significantly limits the attack surface, but in scenarios where devices are deployed in accessible locations or during supply chain stages, this vulnerability could enable extraction of proprietary firmware and intellectual property.

Detection Methods for CVE-2025-14858

Indicators of Compromise

• Unexpected SPI interface connections or probing on LR11xx devices
• Unauthorized physical access to IoT devices or equipment containing LR11xx transceivers
• Evidence of firmware validity check commands followed by unusual memory read patterns
• Signs of device tampering or physical interface manipulation

Detection Strategies

• Implement physical tamper detection mechanisms on devices containing LR11xx transceivers
• Monitor and log SPI interface activity patterns where possible, flagging unusual command sequences
• Deploy asset tracking and physical security controls for IoT deployments
• Conduct periodic physical inspections of devices in accessible deployment locations

Monitoring Recommendations

• Establish physical security perimeters around deployed IoT devices using LR11xx transceivers
• Implement chain of custody protocols during device manufacturing, shipping, and deployment
• Consider tamper-evident enclosures for devices in publicly accessible areas
• Document and audit all authorized physical access to vulnerable device hardware

How to Mitigate CVE-2025-14858

Immediate Actions Required

• Review the Semtech Security Bulletin SEM-PSA-2026-001 for vendor guidance
• Identify all deployed Semtech LR11xx LoRa transceivers in your environment
• Assess physical security controls around devices containing vulnerable components
• Prioritize firmware updates for devices in less physically secure deployment scenarios

Patch Information

Semtech has published security guidance regarding this vulnerability. Refer to the Semtech Security Bulletin SEM-PSA-2026-001 for official patch information and updated firmware versions that address this memory sanitization issue. Apply firmware updates to all affected LR11xx transceivers according to vendor recommendations.

Workarounds

• Restrict physical access to devices containing LR11xx transceivers through enclosures or secured deployment locations
• Implement tamper-evident seals or physical intrusion detection on device housings
• Where feasible, disable or restrict SPI interface access in production deployments
• Apply defense-in-depth measures assuming firmware contents may be extractable by determined attackers with physical access
• Consider additional authentication mechanisms for SPI interface commands if supported by your implementation

For environments where firmware updates cannot be immediately applied, organizations should evaluate whether the sensitivity of the firmware contents warrants enhanced physical security measures or device replacement with patched versions.