Read the docs
TI-2025-13552 Aliases CVE-2025-14857GHSA-xjjj-2993-4g39

Semtech LR11xx Memory Write Access Control Bypass

Priority LOW 26CWE-123Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Fix Fixed LR1110 (Semtech): TRX FW 0x0402LR1120 (Semtech): TRX FW 0x0202+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SemtechLR1110before TRX FW 0x0402TRX FW 0x0402Patch availableCNA
SemtechLR1120before TRX FW 0x0202TRX FW 0x0202Patch availableCNA
SemtechLR1121before TRX FW 0x0104TRX FW 0x0104Patch availableCNA
  • LR1110 VendorSemtech Affected before TRX FW 0x0402 Fixed in TRX FW 0x0402 Patch available CNA
  • LR1120 VendorSemtech Affected before TRX FW 0x0202 Fixed in TRX FW 0x0202 Patch available CNA
  • LR1121 VendorSemtech Affected before TRX FW 0x0104 Fixed in TRX FW 0x0104 Patch available CNA

Remediation

  • Fix · CNA LR1110 (Semtech) Fixed in TRX FW 0x0402
  • Fix · CNA LR1120 (Semtech) Fixed in TRX FW 0x0202
  • Fix · CNA LR1121 (Semtech) Fixed in TRX FW 0x0104

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Semtech LR1110, LR1120, LR1121 TRX FW 0x0104, TRX FW 0x0202, TRX FW 0x0402

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-13553 Semtech LR11xx Encrypted Firmware DisclosurePriority LOW 24
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14857
  2. 2026-10-03 Alias added: GHSA-xjjj-2993-4g39

References

Other 1

  • TI-2022-18650 Buffer Overflow in `ProcessRadioRxDone` in LoRaMac-node CVSS 3.1CRITICAL 9.8
  • TI-2020-08942 Potential Buffer Overflow in LoRaMac-node CVSS 3.1HIGH 8.8
  • TI-2025-13554 Semtech LR11xx Secure Boot Bypass CVSS 4.0HIGH 7.0
  • TI-2026-71207 Out-of-bounds write in Semtech LR11xx transceiver firmware CVSS 4.0MEDIUM 5.2
  • TI-2020-03545 Use After Free in in cups_update_info in LoRa Basics Station CVSS 3.1MEDIUM 5.0
  • TI-2025-13553 Semtech LR11xx Encrypted Firmware Disclosure CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences