CVE-2026-109439: Missing Authentication for Critical Function in LANTRONIX XPress-DR

CVE-2026-109439 describes a missing authentication vulnerability in Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware versions up to 8.1.0.0. The vulnerability allows remote attackers to interact with the device's UDP configuration protocol on port 30718 without authentication. Specifically, attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with a 0x78-byte body to overwrite device IP address and serial-channel forwarding records. These changes are committed to EEPROM and persist across device reboots. The affected product series reached end-of-life and end-of-support in February 2025.

An unauthenticated remote attacker can read sensitive device configuration data and modify critical network settings such as IP address and serial-channel forwarding. These unauthorized changes persist after reboot, potentially disrupting device operation or enabling further attacks. The vulnerability has a CVSS 4.0 score of 9.3 (critical), indicating high impact with no required privileges or user interaction.

The Lantronix XPress-DR product series reached end-of-life and end-of-support in February 2025. No official patch or fix is available. Users should consider replacing affected devices with supported hardware. Network-level mitigations such as blocking UDP port 30718 from untrusted sources may reduce exposure.