Read the docs
TI-2026-74312 Aliases CVE-2026-109439

Lantronix XPress-DR accepts unauthenticated configuration writes

Priority MEDIUM 49CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Lantronix XPress-DR and XPress-DR-I firmware through 8.1.0.0 lacks authentication on its UDP configuration protocol on port 30718 (CWE-306). A remote attacker without credentials can read live device configuration and overwrite it, including the IP address and serial-channel forwarding records. The changes are written to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life in February 2025.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00618 49th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LantronixXPress-DRup to 8.1.0.0—No fix listedCNA
LantronixXPress-DR-Iup to 8.1.0.0—No fix listedCNA
  • XPress-DR VendorLantronix Affected up to 8.1.0.0 Fixed in — No fix listed CNA
  • XPress-DR-I VendorLantronix Affected up to 8.1.0.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for XPress-DR. The sources list no fixed version for XPress-DR-I.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-109439
  2. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-41112 Lantronix EDS5000, G520, and X300 OS Command Injection KEVCVSS 4.0CRITICAL 9.3
  • TI-2021-04926 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04937 Stack-based buffer overflow in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2026-55403 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation CVSS 4.0CRITICAL 10.0
  • TI-2021-04928 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04917 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
See all 61 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences