# CVE-2025-14858: Semtech LR11xx information disclosure in firmware validation

Source: https://junglewise.ai/threats/cve-2025-14858-semtech-lr11xx-information-disclosure-in-firmware-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2025-14858 · Severity: info · CVSS 5.1 · Published 2026-04-07

Semtech LR11xx transceivers, which are chips used for long-range wireless communication in IoT devices, contain a flaw that could allow an attacker to steal sensitive firmware data. By physically accessing the device's hardware interface, an attacker can recover pieces of decrypted software that were supposed to remain protected. This could lead to the theft of intellectual property or help an attacker find further ways to compromise the device.

Technologies: [Semtech LR1110](https://junglewise.ai/threats/technologies/lr1110), [Semtech LR1120](https://junglewise.ai/threats/technologies/lr1120), [Semtech LR1121](https://junglewise.ai/threats/technologies/lr1121). Vendors: [Semtech](https://junglewise.ai/threats/vendors/semtech).

## Quick answers

**Is CVE-2025-14858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14858 being exploited in the wild.

**How severe is CVE-2025-14858?** Informational severity, with a CVSS score of 5.1, published 7 April 2026.

**Which products and versions are affected?** Semtech LR1110 TRX FW < 0x0402; Semtech LR1120 TRX FW < 0x0202; Semtech LR1121 TRX FW < 0x0104.

**Is there a fix for CVE-2025-14858?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-14858 attacked?** It is attacked with physical access, in device firmware.

**Am I affected by CVE-2025-14858?** Check whether you run Semtech LR1110, Semtech LR1120 or Semtech LR1121 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability (CWE-226) exists in the firmware validation functionality of Semtech LR11xx transceivers. When the device performs a firmware validity check via the Serial Peripheral Interface (SPI), it decrypts the firmware block-by-block; however, the final decrypted block is not cleared from memory upon completion. An attacker with physical access to the SPI interface can issue memory read commands to retrieve these residual decrypted contents. This allows for the gradual extraction of firmware data, effectively bypassing the device's firmware encryption protections. The issue is addressed in firmware versions TRX FW 0x0402 (LR1110), 0x0202 (LR1120), and 0x0104 (LR1121).

## Affected products

- Semtech LR1110 TRX FW < 0x0402
- Semtech LR1120 TRX FW < 0x0202
- Semtech LR1121 TRX FW < 0x0104

## Timeline

- 2026-04-07: disclosed: Initial disclosure by Semtech
- 2026-04-07: advisory: NVD publication date

## References

- [https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001](https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-001)

## Related threats

- [Semtech LR11xx secure boot bypass via cryptographic hash collision](https://junglewise.ai/threats/cve-2025-14859-semtech-lr11xx-secure-boot-bypass-via-cryptographic-hash)
- [Semtech LoRa LR11xxx improper access control in SPI memory write](https://junglewise.ai/threats/cve-2025-14857-semtech-lora-lr11xxx-improper-access-control-in-spi-memory-write)