The vulnerability lies in the firmware validation routine of Semtech LR11xx LoRa transceivers. During a firmware validity check over the SPI interface, the device decrypts encrypted firmware blocks one by one. Unfortunately, the final decrypted block is not cleared from memory after validation completes, leaving residual data that can be read by subsequent memory read operations. This flaw effectively bypasses the encryption protection on firmware, allowing an attacker to retrieve confidential firmware contents and potentially compromise device integrity. The weakness corresponds to CWE‑226, a failure to properly delete or overwrite intermediate state data.

Semtech LR1110, Semtech LR1120, and Semtech LR1121 transceivers running early firmware versions are affected. The specific firmware releases that contain the flaw are not enumerated in the public advisory, but the problem has been identified in the earliest builds of these boards.

The CVSS score of 5.1 indicates moderate severity, and no EPSS data or KEV listing is available. This flaw is local; an attacker needs physical access to the device’s SPI interface to trigger decryption and extract memory contents. Because the attack does not rely on network or remote interfaces, exploitation risk is confined to environments where physical compromise is feasible. Nevertheless, recovery of the decrypted firmware can aid future attacks, so the vulnerability should be remediated promptly.