Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-109439: Lantronix XPress-DR devices allow remote config change
CVE-2026-109439 · published 4 days ago
Summary
The XPress-DR and XPress-DR-I network devices let anyone on the network send special UDP packets to read or overwrite the device's settings, including its IP address. This can be done without a password and the changes remain after the device is rebooted. Apply any available firmware updates or replace the device, and restrict network access to the UDP port used for configuration.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| lantronix | xpress-dr | <= 8.1.0.0 |
| lantronix | xpress-dr-i | <= 8.1.0.0 |
Original advisory text
Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.3
Critical
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published14 Oct 2026
Updated17 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta