CVE-2025-14857

Enriched by CISA Exploit
 

An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.
https://nvd.nist.gov/vuln/detail/CVE-2025-14857

Categories

CWE-123 : Write-what-where Condition
Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Use tools that are integrated duringcompilation to insert runtime error-checking mechanismsrelated to memory safety errors, such as AddressSanitizer(ASan) for C/C++ [REF-1518]. Use a language that provides appropriate memory abstractions. Use OS-level preventative functionality integrated after the fact. Not a complete solution. Chain: Python library does not limit the resources used to process images that specify a very large number of bands (CWE-1284), leading to excessive memory consumption (CWE-789) or an integer overflow (CWE-190). Chain: 3D renderer has an integer overflow (CWE-190) leading to write-what-where condition (CWE-123) using a crafted image.

References


 

AFFECTED (from MITRE)

Vendor Product Versions
Semtech LR1110
  • < TRX FW 0x0402 [affected]
Semtech LR1120
  • < TRX FW 0x0202 [affected]
Semtech LR1121
  • < TRX FW 0x0104 [affected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe start end
Configuration 1
OR
  OR
   cpe:2.3:a:semtech:lr1110:*:*:*:*:*:*:*:* >= 0 < trx_fw_0x0402
  OR
   cpe:2.3:a:semtech:lr1120:*:*:*:*:*:*:*:* >= 0 < trx_fw_0x0202
  OR
   cpe:2.3:a:semtech:lr1121:*:*:*:*:*:*:*:* >= 0 < trx_fw_0x0104

REMEDIATION


EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
https://github.com/Ermensonx/CVE-2025-14857-MongoBleed

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
No entry