Lr1110 EUVD-2025-209284

The CVSS v4.0 score of 5.1 reflects a physical attack vector (AV:P) with low attack complexity (AC:L), no privileges required (PR:N), and high confidentiality impact (VC:H)-appropriate for a firmware disclosure issue accessible only via direct SPI interface tampering. The attack vector constraint (AV:P) significantly limits real-world exploitability compared to network-based vulnerabilities; an attacker must have hands-on physical access to the device's SPI pins or debugging interface, making opportunistic exploitation infeasible in most deployments. However, for adversaries with supply-chain access, device interdiction capabilities, or insider threats, this presents a genuine risk for extracting proprietary firmware and deriving cryptographic keys or algorithmic details. No EPSS, KEV status, or public exploit code has been reported, and the vulnerability affects only early firmware versions, suggesting remediation is already available or actively deployed. The real-world priority depends on the deployment context: consumer IoT devices in field locations represent lower risk, while critical infrastructure, military, or high-security LoRa deployments warrant urgent patching. From an SSVC perspective, exploitation is technically possible but not automatable (requires physical access), and the technical impact is limited to confidentiality (firmware disclosure), not integrity or availability of the device itself.

An attacker with physical access to a deployed LoRa device (e.g., through supply-chain interception or field access) probes the SPI interface using standard debugging tools (logic analyzer, bus pirate, or custom FPGA). The attacker triggers the firmware validity check command to cause the device to decrypt firmware blocks, then immediately issues SPI read commands to extract the uncleared last decrypted block from the transceiver's memory buffer. By repeating this process across multiple validation cycles or by accessing different regions of the device's RAM, the attacker reconstructs the complete decrypted firmware, obtaining proprietary algorithms, cryptographic keys, or device identifiers. No sophisticated exploit toolkit is required-commodity hardware and standard SPI protocol knowledge suffice-but the attack requires direct physical device access, limiting its scope primarily to supply-chain threats or insider scenarios.