CVE-2025-14857

The record

An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.

Affected packages

Related vulnerabilities

• CVE-2026-81579 In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the… CWE-123
• CVE-2026-20469 In trusted_mem, there is a possible escalation of privilege due to improper input… CWE-123
• CVE-2026-45257 The KTLS receive path decrypted each record in place, assuming that the mbufs holding… CWE-123
• GHSA-g6pc-6676-c23j Remotion: arbitrary file write vulnerability CWE-123
• CVE-2026-30121 remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write… CWE-123
• CVE-2026-43284 In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid… CWE-123
• CVE-2026-41952 Local privilege escalation due to improper input validation. CWE-123
• CVE-2025-69809 A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated… CWE-123