CVE-2025-14857

MEDIUM

Semtech LR11xx Memory Write Access Control Bypass

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-14857 has a selected CVSS score of 5.4 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 7, 2026 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

LR1110

Browse Semtech / LR1110

Default status: unaffected

CVE ListBefore TRX FW 0x0402affected

LR1120

Browse Semtech / LR1120

Default status: unaffected

CVE ListBefore TRX FW 0x0202affected

LR1121

Browse Semtech / LR1121

Default status: unaffected

CVE ListBefore TRX FW 0x0104affected

Proofs of concept

1

Repository PoCs

GitHubErmensonx/CVE-2025-14857-MongoBleedRepository PoCby Ermensonx0Exploit11 files

73.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a functional exploit for CVE-2025-14847 (MongoBleed), a heap memory disclosure vulnerability in MongoDB's zlib compression layer. It includes a Python script (poc.py) that constructs and sends a malicious OP_COMPRESSED packet with a falsified uncompressed size to trigger the leak, then receives and analyzes the leaked heap memory for sensitive patterns.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README.md documentation file and a poc.py Python script that implement a proof-of-concept for CVE-2025-14847 (MongoBleed). The code constructs a malformed MongoDB OP_COMPRESSED packet to trigger a heap memory disclosure vulnerability. No concealed executable behavior, persistence mechanisms, credential exfiltration to external hosts, or unrelated payloads were observed. The script performs only the advertised exploit behavior against a user-supplied target.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareMongoDB
Attack typesMemory DisclosureHeap Inspection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is classified as an exploit because it contains code (poc.py) that actively exercises the CVE-2025-14847 vulnerability by sending a crafted network packet to trigger a heap memory leak and exfiltrate data from a vulnerable MongoDB server. The README explicitly labels it as a 'PoC Funcional' and 'Exploit 100% Funcional', and the code includes both a vulnerability check and an exploitation mode that leaks and analyzes memory.

README.md:1-2README.md:20poc.py:95-129poc.py:192-275

Requirements

  • Network access to a vulnerable MongoDB instance (versions 4.4.0-4.4.29, 5.0.0-5.0.31, 6.0.0-6.0.26, 7.0.0-7.0.27, 8.0.0-8.0.16, 8.2.0-8.2.2) with zlib compression enabled.README.md:121-133README.md:167-175
  • Python 3.8+ with standard libraries (socket, struct, zlib, re, json).poc.py:11-23

Observed behavior

  • Connects to a target MongoDB instance on port 27017.poc.py:65-84
  • Constructs a malicious OP_COMPRESSED packet with a small compressed payload but a large declared uncompressed size (default 1MB) to trigger a heap memory leak.poc.py:95-129
  • Sends the malicious packet and receives the server's response, which includes leaked heap memory.poc.py:203-246
  • Analyzes the leaked memory for sensitive patterns such as JWT tokens, UUIDs, internal IPs, and application-specific keys using regular expressions.poc.py:277-323
  • Optionally saves the raw memory dump to a file and generates a JSON report of findings.poc.py:252-255poc.py:325-337
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Payload withheldThe core vulnerability exploitation logic that triggers heap memory disclosure in MongoDB's zlib compression layer.poc.py:95-129
Network Behavior
Payload withheldThe script only communicates with the explicitly provided target; no hardcoded external addresses or data exfiltration channels are present.poc.py:57-63poc.py:65-93poc.py:192-275
Data Handling
Payload withheldNo network exfiltration of leaked data; all output remains local to the machine running the PoC.poc.py:248-255poc.py:277-323poc.py:325-337
Review boundaries

What the analysis did not establish

  • The evidence includes only two of the eleven files in the repository (README.md and poc.py). The remaining nine files, including live_leaker.py, popular_heap.py, docker-compose.yml, and init-db.js, are omitted and their contents are not available for analysis.
  • The CVE context provided in the evidence envelope is for CVE-2025-14857 (Semtech LoRa), which does not match the CVE-2025-14847 (MongoBleed) discussed in the artifact. This discrepancy is noted but does not affect the classification of the artifact's code.
  • Only two of eleven files in the repository were provided as readable text; the remaining nine files (including live_leaker.py, popular_heap.py, docker-compose.yml, init-db.js, and documentation files) were not inspected. Their content could contain additional behavior not visible in this review.
  • Binary content, if any existed in the omitted files, was not analyzed per the evidence envelope's binary policy.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Ermensonx/CVE-2025-14857-MongoBleedCreated Vuln labCVE-2025-14857Compose · images

1 Compose manifest · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose environment running MongoDB 7.0.5 with zlib compression enabled, initialized with simulated Rainbow Six Siege backend data. The environment is designed as a vulnerability lab for CVE-2025-14847 (MongoBleed), a heap memory disclosure vulnerability in MongoDB's zlib compression layer.

docker-compose.yml:1-10README.md:1-20

Lab assessment

Vulnerability lab

The README explicitly states this is a 'Prova de Conceito Completa para CVE-2025-14847 (MongoBleed)' (Complete Proof of Concept for CVE-2025-14847). The Docker Compose file configures a MongoDB 7.0.5 instance with zlib compression enabled, which is the vulnerable configuration. The init-db.js script populates the database with simulated R6 data to serve as target data for the exploit. Python scripts (poc.py, live_leaker.py) are provided to exercise the vulnerability against the lab target.

README.md:1-3docker-compose.yml:1-10init-db.js:1-88
Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mongodb

vulnerable targetdatabase server

MongoDB 7.0.5 container with zlib compression enabled, bound to all IPs on port 27017. It is initialized with a script that creates a database 'r6_custom_matchmaking' containing 1000 player records, 500 active sessions, and a system configuration document, all containing simulated sensitive tokens and credentials.

docker-compose.yml:1-10init-db.js:1-88

poc.py

exploit scriptvulnerability checker

Python script that implements the CVE-2025-14847 exploit by sending a malformed OP_COMPRESSED packet with an oversized uncompressedSize claim to trigger heap memory disclosure. It includes a probe mode to check if the target is vulnerable and an exploit mode to capture and analyze leaked memory for R6-specific patterns.

poc.py:1-408

live_leaker.py

exploit scriptincremental scanner

Advanced Python script that iteratively tests different document lengths to maximize memory leak extraction. It sends malformed OP_COMPRESSED packets and analyzes responses for R6-specific patterns, tracking unique leaks across categories.

live_leaker.py:1-389

popular_heap.py

heap priming script

Python script that executes multiple MongoDB queries via docker exec to ensure target data (tokens, credentials) is resident in the MongoDB heap before exploitation. It runs queries against the active_sessions, player_stats, and system_config collections.

popular_heap.py:1-41

init-db.js

database initializer

JavaScript file mounted into the MongoDB container's init directory. It creates the 'r6_custom_matchmaking' database and populates it with 1000 player records, 500 active sessions, and a system configuration document, all containing simulated sensitive data such as JWT tokens, server auth tokens, API keys, and internal IPs.

init-db.js:1-88
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-14857

Insufficient evidence

The unit_cve_ids array contains only CVE-2025-14857, but the evidence files (README.md, poc.py, live_leaker.py, init-db.js, docker-compose.yml) consistently reference CVE-2025-14847. The README title and all script headers mention CVE-2025-14847. The repository name includes CVE-2025-14857, but no technical content describes or exercises CVE-2025-14857. The relationship between the two CVEs is not explained in the supplied evidence.

README.md:1-3poc.py:1-5live_leaker.py:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:72-74
  • Python 3.8+ installed on the host to run the exploit scripts.README.md:72-74
  • The MongoDB container must be running and initialized with the init-db.js script to populate the heap with target data.README.md:78-82
  • The attacker must have network access to the MongoDB port (27017) on the target host.docker-compose.yml:5-6

Evidence-described exercise path

  1. Start the vulnerable MongoDB environment using 'docker-compose up -d'.README.md:78-80
  2. Wait for the database to initialize and verify with 'docker logs cve-2025-14847-lab | grep "R6 MASSIVE"'.README.md:82-83
  3. Prime the heap with target data by running 'python3 popular_heap.py 50'.README.md:88-89
  4. Check if the target is vulnerable using 'python3 poc.py --target 127.0.0.1 --check'.README.md:91-92
  5. Execute the live leaker exploit with 'timeout 30 python3 live_leaker.py --host 127.0.0.1 --min 200 --max 3000 --save results.json' to extract heap memory and detect R6 patterns.README.md:94-95
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own MongoDB container. The exploit scripts connect to 127.0.0.1:27017 (the lab target) and send malformed packets to trigger memory disclosure. The popular_heap.py script uses 'docker exec' to run queries inside the lab container. No evidence shows host escape, external connections, persistence, credential theft from the host, or destructive actions beyond the intended lab exercise. The port mapping (27017:27017) and bind mount of init-db.js are standard lab requirements.

poc.py:1-408live_leaker.py:1-389popular_heap.py:1-41docker-compose.yml:1-10
Review boundaries

What the analysis did not establish

  • The unit_cve_ids array contains CVE-2025-14857, but all evidence references CVE-2025-14847. The relationship between these identifiers is not explained in the supplied packet.
  • The packet does not include the referenced GUIA_TECNICO_COMPLETO.md, RELATORIO_TESTES.md, or other files listed in the file inventory, so their content cannot be assessed.
  • The exploit scripts are text-based and their behavior is fully visible; no binary files are present.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2