All vulnerabilities
CVE-2026-109439

Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718

LANTRONIX XPress-DR
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.62%Chance of exploitation activity in the next 30 days, higher than 48% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published14 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.

Text from CVE List

Affected versions 2

  • XPress-DRaffected: all versions through 8.1.0.0CVE List
  • XPress-DR-Iaffected: all versions through 8.1.0.0CVE List

References 2