Executive brief
Semtech LoRa transceivers, which are used for long-range wireless communication in IoT devices, contain a security flaw in their early firmware versions. An attacker with physical access to the device's internal wiring can bypass security controls to temporarily take control of the chip's operations. While this allows for unauthorized code execution, the impact is limited because the device's secure boot prevents permanent changes, and sensitive cryptographic keys remain isolated from the attacker.
Technical details
An improper access control vulnerability (CWE-123) exists in the firmware of Semtech LR11xxx transceivers. The memory write command, accessible via the physical Serial Peripheral Interface (SPI), fails to enforce write protection on the program call stack. By exploiting this, a physical attacker can overwrite stack memory to hijack program control flow and achieve arbitrary code execution. The exploit is non-persistent as the device's secure boot mechanism prevents permanent firmware modification, and the hardware crypto engine prevents the attacker from accessing cryptographic keys. The issue is resolved in firmware versions 0x0402 (LR1110), 0x0202 (LR1120), and 0x0104 (LR1121).
Affected products
- Semtech LR1110 TRX FW < 0x0402
- Semtech LR1120 TRX FW < 0x0202
- Semtech LR1121 TRX FW < 0x0104
Timeline
- 2026-04-07: advisory: Semtech published security bulletin SEM-PSA-2026-001
- 2026-04-07: disclosed: CVE-2025-14857 published to NVD