Lr1121 Transceiver
Monthly
An out-of-bounds write in the SPI host command interface of Semtech's LR11xx transceiver firmware lets an attacker who already has hands-on hardware access and logical control of the SPI bus send a crafted host command with an oversized length field, causing the firmware to write up to 254 arbitrary bytes beyond an internal non-persistent memory buffer. The affected product lines are the LR1110 transceiver and modem-E, the LR1120 transceiver, and the LR1121 transceiver and modem-E; the vulnerability is rated 5.2 (CVSS 4.0) and assessed at CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, meaning integrity and availability of the transceiver can be corrupted but no confidentiality loss occurs. There is no network or remote attack vector - exploitation requires physical access to the device plus SPI bus access - and no public exploit identified at time of analysis, with no confirmed active exploitation (CISA KEV) reported. Because the corrupted buffer is non-persistent, effects may be cleared by a device reset, keeping real-world risk low to moderate.
An out-of-bounds write in the SPI host command interface of Semtech's LR11xx transceiver firmware lets an attacker who already has hands-on hardware access and logical control of the SPI bus send a crafted host command with an oversized length field, causing the firmware to write up to 254 arbitrary bytes beyond an internal non-persistent memory buffer. The affected product lines are the LR1110 transceiver and modem-E, the LR1120 transceiver, and the LR1121 transceiver and modem-E; the vulnerability is rated 5.2 (CVSS 4.0) and assessed at CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, meaning integrity and availability of the transceiver can be corrupted but no confidentiality loss occurs. There is no network or remote attack vector - exploitation requires physical access to the device plus SPI bus access - and no public exploit identified at time of analysis, with no confirmed active exploitation (CISA KEV) reported. Because the corrupted buffer is non-persistent, effects may be cleared by a device reset, keeping real-world risk low to moderate.