CVE-2025-14857 - Vulnerability Analysis

Overview

Semtech LoRa LR11xxx transceivers with early firmware versions contain an improper access control vulnerability caused by lack of write protection enforcement on the program call stack via SPI interface, letting attackers with physical SPI access hijack program control flow and execute limited arbitrary code during active session.

Severity & Score

Impact

Attackers with physical SPI access can hijack program control flow and execute limited arbitrary code temporarily during active session without persistent firmware modification.

Mitigation

Update to the latest firmware version that enforces write protection on the program call stack.

References

• https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner