CVE-2025-14858
Raw vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:XSummary
CVE-2025-14858 is a medium-severity Sensitive Information in Resource Not Removed Before Reuse (CWE-226) vulnerability in Semtech LR11xx LoRa (inferred from references). Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to MP-6 (Media Sanitization) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209284
Vulnerability Data
The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware validation functionality. When a host issues a firmware validity check command via the SPI interface, the device decrypts the provided encrypted firmware…
more
package block-by-block to validate its integrity. However, the last decrypted firmware block remains uncleared in memory after the validation process completes. An attacker with access to the SPI interface can subsequently issue memory read commands to retrieve the decrypted firmware contents from this residual memory, effectively bypassing the firmware encryption protection mechanism. The attack requires physical access to the device's SPI interface.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 4 OS baselines
V14.2.8V14.3.1
Mitigating Controls (NIST 800-53 r5) AI
MP-6 requires sanitization of media before release for reuse, directly stopping sensitive data from remaining in resources made available to others.
SC-4 requires preventing unintended information transfer through shared system resources such as memory, which is achieved by clearing data before reuse.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit example calls for removing confidential data (e.g., from process memory) after use, directly preventing reuse of uncleared resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicitly requires secure deletion of information before resources are reused or disposed.
Mandates secure disposal or re-use of equipment, covering media sanitization but not in-memory reuse.
Security testing can detect failures to sanitize resources before reuse.
Secure SDLC includes requirements for clearing sensitive data during resource lifecycle transitions.
Secure coding practices can prevent leaving sensitive data in memory or files before reuse.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248579 OL 8 must restrict access to the kernel message buffer. prevents CWE-226
Oracle Linux 9 (1 rule)
- V-271745 OL 9 must restrict access to the kernel message buffer. prevents CWE-226
RHEL 8 (1 rule)
- V-230269 RHEL 8 must restrict access to the kernel message buffer. prevents CWE-226
RHEL 9 (1 rule)
- V-257797 RHEL 9 must restrict access to the kernel message buffer. prevents CWE-226