Read the docs
TI-2025-13553 Aliases CVE-2025-14858GHSA-pq38-4mfg-vpxj

Semtech LR11xx Encrypted Firmware Disclosure

Priority LOW 24CWE-226Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware validation functionality. When a host issues a firmware validity check command via the SPI interface, the device decrypts the provided encrypted firmware package block-by-block to validate its integrity. However, the last decrypted firmware block remains uncleared in memory after the validation process completes. An attacker with access to the SPI interface can subsequently issue memory read commands to retrieve the decrypted firmware contents from this residual memory, effectively bypassing the firmware encryption protection mechanism. The attack requires physical access to the device's SPI interface.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00117 1st percentileScored 2026-11-07
Fix Fixed LR1110 (Semtech): TRX FW 0x0402LR1120 (Semtech): TRX FW 0x0202+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SemtechLR1110before TRX FW 0x0402TRX FW 0x0402Patch availableCNA
SemtechLR1120before TRX FW 0x0202TRX FW 0x0202Patch availableCNA
SemtechLR1121before TRX FW 0x0104TRX FW 0x0104Patch availableCNA
  • LR1110 VendorSemtech Affected before TRX FW 0x0402 Fixed in TRX FW 0x0402 Patch available CNA
  • LR1120 VendorSemtech Affected before TRX FW 0x0202 Fixed in TRX FW 0x0202 Patch available CNA
  • LR1121 VendorSemtech Affected before TRX FW 0x0104 Fixed in TRX FW 0x0104 Patch available CNA

Remediation

  • Fix · CNA LR1110 (Semtech) Fixed in TRX FW 0x0402
  • Fix · CNA LR1120 (Semtech) Fixed in TRX FW 0x0202
  • Fix · CNA LR1121 (Semtech) Fixed in TRX FW 0x0104

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Semtech LR1110, LR1120, LR1121 TRX FW 0x0104, TRX FW 0x0202, TRX FW 0x0402

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-13552 Semtech LR11xx Memory Write Access Control BypassPriority LOW 26
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14858
  2. 2026-10-03 Alias added: GHSA-pq38-4mfg-vpxj

References

Other 1

  • TI-2022-18650 Buffer Overflow in `ProcessRadioRxDone` in LoRaMac-node CVSS 3.1CRITICAL 9.8
  • TI-2020-08942 Potential Buffer Overflow in LoRaMac-node CVSS 3.1HIGH 8.8
  • TI-2025-13554 Semtech LR11xx Secure Boot Bypass CVSS 4.0HIGH 7.0
  • TI-2025-13552 Semtech LR11xx Memory Write Access Control Bypass CVSS 4.0MEDIUM 5.4
  • TI-2026-71207 Out-of-bounds write in Semtech LR11xx transceiver firmware CVSS 4.0MEDIUM 5.2
  • TI-2020-03545 Use After Free in in cups_update_info in LoRa Basics Station CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences