An improper access control flaw in Semtech LoRa transceivers allows anyone with physical access to the SPI interface to issue memory write commands that bypass write protection on the program call stack. This vulnerability can be exploited to overwrite stack memory, redirect program flow, and execute limited arbitrary code during the active session. However, the device's secure boot and crypto engine prevent persistent firmware changes, and any modifications are lost when the device reboots or physical access is removed.

The flaw affects Semtech LR1110, LR1120, and LR1121 transceivers running early firmware releases that do not enforce stack write protection. The exact firmware versions are not listed, but the issue applies to the initial firmware versions before the fix was implemented.

The CVSS score is 5.4, indicating moderate severity. No EPSS score is available, and the vulnerability is not catalogued in CISA's KEV list. Exploitation requires direct physical access to the SPI bus, limiting the attack scope. Once exploited, the attacker can hijack program control flow but cannot make persistent changes due to secure boot enforcement and cryptographic key isolation.