CVE-2025-14858

The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware validation functionality. When a host issues a firmware validity check command via the SPI interface, the device decrypts the provided encrypted firmware package block-by-block to validate its integrity. However, the last decrypted firmware block remains uncleared in memory after the validation process completes. An attacker with access to the SPI interface can subsequently issue memory read commands to retrieve the decrypted firmware contents from this residual memory, effectively bypassing the firmware encryption protection mechanism. The attack requires physical access to the device's SPI interface.

The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware validation functionality. When a host issues a firmware validity check command via the SPI interface, the device decrypts the provided encrypted firmware package block-by-block to validate its integrity. However, the last decrypted firmware block remains uncleared in memory after the validation process completes. An attacker with access to the SPI interface can subsequently issue memory read commands to retrieve the decrypted firmware contents from this residual memory, effectively bypassing the firmware encryption protection mechanism. The attack requires physical access to the device's SPI interface.

Los transceptores LoRa Semtech LR11xx que ejecutan versiones tempranas de firmware contienen una vulnerabilidad de revelación de información en su funcionalidad de validación de firmware. Cuando un host emite un comando de verificación de validez de firmware a través de la interfaz SPI, el dispositivo descifra el paquete de firmware cifrado proporcionado bloque por bloque para validar su integridad. Sin embargo, el último bloque de firmware descifrado permanece sin borrar en la memoria una vez que el proceso de validación finaliza. Un atacante con acceso a la interfaz SPI puede posteriormente emitir comandos de lectura de memoria para recuperar el contenido del firmware descifrado de esta memoria residual, eludiendo eficazmente el mecanismo de protección de cifrado del firmware. El ataque requiere acceso físico a la interfaz SPI del dispositivo.