CVE-2026-109439

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Lantronix XPress-DR Firmware

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109439

EUVD

EUVD-2026-101337

Affected Vendors & Products

Vendor	Product	Version / Range
LANTRONIX	XPress-DR	0
LANTRONIX	XPress-DR-I	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Lantronix XPress-DR and XPress-DR-I devices running firmware through version 8.1.0.0. It allows unauthenticated remote attackers to read and permanently modify device configurations via the unauthenticated UDP configuration protocol on port 30718. Attackers can send specific crafted frames to retrieve or overwrite configuration data, including IP addresses and serial-channel forwarding records. Changes persist across reboots as they are written to EEPROM.

Detection Guidance

To detect this vulnerability, scan your network for devices listening on UDP port 30718. Use tools like nmap with the command: nmap -sU -p 30718 <target_IP>. If the port is open, send a type 0xF8 query to check for a response containing configuration data.

Impact Analysis

Unauthenticated attackers could gain full control over device configurations, leading to network disruptions, unauthorized access, or persistent compromise. Since changes persist after reboots, attackers could maintain control even if the device is restarted. The lack of patches due to end-of-life status means risks remain unaddressed.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Persistent configuration changes may also result in non-compliance with integrity and availability standards. Organizations using affected devices must assess potential regulatory impacts.

Mitigation Strategies

Since the XPress-DR series is end-of-life and no patches are available, isolate affected devices from untrusted networks. Block UDP port 30718 at the firewall. Replace or upgrade devices if possible, as the product line is no longer supported.

Hi! I’m here to help you understand CVE-2026-109439. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70