CVE-2026-109439
9.8CriticalPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-306
Impact
Unauthenticated remote attackers can read and permanently rewrite device network and serial forwarding configurations over the network. Exploitation requires sending crafted UDP packets without credentials, causing persistent changes across reboots.
Root cause
The device exposes an unauthenticated UDP configuration service on port 30718 that processes read and write commands directly into EEPROM.
Affected systems
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No patch is available as the devices reached end-of-life in February 2025; immediately block or firewall UDP port 30718 at network boundaries and isolate devices on a dedicated management VLAN.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.