PT-2026-30995 · Semtech · Lr11Xx Lora Transceivers

Published 2026-04-07 · Updated 2026-04-08 · CVE-2025-14858

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:X

Name of the Vulnerable Software and Affected Versions Semtech LR11xx LoRa transceivers (affected versions not specified)

Description The Semtech LR11xx LoRa transceivers running early firmware versions has an issue where the last decrypted firmware block remains in memory after a firmware validity check. An attacker with access to the SPI interface can retrieve the decrypted firmware contents from residual memory, bypassing firmware encryption. The attack requires physical access to the device's SPI interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-226

Related Identifiers

CVE-2025-14858

Affected Products

Lr11Xx Lora Transceivers

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-14858 · Security Note
• https://semtech.com/company/security/security-bulletins/sem-psa-2026-001 · Note
• https://twitter.com/CVEnew/status/2041711887944184021 · Twitter Post