Lr1110 EUVD-2025-209282

The CVSS 5.4 score accurately reflects the physical attack constraint (AV:P) combined with high confidentiality and integrity impact (VC:H, VI:H). The attack vector requires direct physical SPI interface access-a significant barrier for remote attackers but feasible for supply-chain actors, maintenance personnel, or adversaries with device possession. EPSS exploitation probability data is not provided; however, the existence of a detailed public vulnerability disclosure (SWI reported, Semtech security bulletin SEM-PSA-2026-001) suggests research-grade understanding. No KEV (CISA Known Exploited Vulnerability) status or public exploit code (POC) is indicated in the input. The CVSS vector shows PR:N (no privileges required) and AC:L (low attack complexity) once physical access is gained, making exploitation straightforward with basic SPI probing tools. The mitigating factors-secure boot preventing persistence, cryptographic key isolation, and loss of modifications upon reboot-significantly reduce real-world risk for typical IoT deployments. This is NOT a critical vulnerability despite the RCE tag, because (1) attack surface is limited to physically accessible devices, (2) impact duration is the session only, and (3) firmware modifications do not persist. Priority should be moderate for supply-chain security contexts and higher for devices in physically accessible environments (e.g., unattended outdoor LoRaWAN gateways).

An attacker with brief physical access to a deployed LoRaWAN gateway (e.g., in an outdoor or semi-secure location) connects a SPI probe or debug interface to the LR1120 transceiver module. Using standard SPI signaling tools (e.g., a logic analyzer or custom firmware script), the attacker sends a crafted memory write command targeting the stack frame of a running firmware function, overwriting the return address. This hijacks control flow to malicious code injected into unused memory regions, allowing the attacker to extract LoRaWAN session keys, decrypt nearby transmissions, or inject rogue packets during the active session. Upon device reboot or when the attacker disconnects, secure boot reloads the legitimate firmware and all modifications are lost, leaving no persistent compromise-but the attacker may have exfiltrated sensitive session data in real time. No public exploit code is identified at time of analysis.