CVE-2026-109439 in XPress-DR
Summary
by MITRE • 10/14/2026
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The Lantronix XPress-DR and XPress-DR-I devices, part of the CoBos-family line of industrial IoT gateways, suffer from a critical missing authentication vulnerability within their firmware versions up to 8.1.0.0. This flaw resides in the unauthenticated UDP configuration protocol operating on port 30718, which was designed for local network management but lacks any form of access control or cryptographic verification. The absence of authentication mechanisms allows remote attackers who have network connectivity to these devices to interact directly with low-level system functions without providing valid credentials. This architectural oversight fundamentally undermines the security boundary between untrusted networks and critical infrastructure components, exposing sensitive configuration data and allowing for unauthorized state changes that persist beyond device reboots due to direct writes to non-volatile memory storage such as EEPROM.
The technical exploitation of this vulnerability involves sending specifically crafted UDP frames to port 30718. Attackers can utilize a type 0xF8 query frame to extract live configuration data from the target device, effectively enabling unauthorized reconnaissance and information disclosure. This capability allows adversaries to map out network topologies, identify connected devices, and gather sensitive operational parameters that could facilitate further attacks or espionage activities. Furthermore, by sending a type 0xFD frame with exactly 0x78 bytes in the body payload, an attacker can overwrite critical configuration records stored on the device. Specifically, this allows for the modification of IP address settings and serial-channel forwarding rules, which are essential for maintaining network connectivity and data transmission pathways within industrial environments.
The operational impact of these capabilities is severe, particularly given that many XPress-DR devices serve as gateways in SCADA systems, manufacturing networks, or other critical infrastructure deployments where reliable communication is paramount. The ability to persistently overwrite configuration settings means that an attacker can permanently alter the device's behavior even after a reboot, making remediation difficult without physical access or manual reconfiguration. By changing IP addresses and forwarding records, attackers can redirect traffic to malicious servers, intercept sensitive data in transit, or isolate devices from their management networks, leading to potential denial of service conditions. The persistence of these changes ensures that the compromise remains active until manually corrected, creating a long-term foothold for adversaries within the network infrastructure.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-613, Insufficient Session Expiration, in the context of persistent state manipulation without proper validation. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1546.009, specifically Event Triggered Execution via COM Port or Serial Channel modifications, and potentially T1136 for creating accounts if new administrative access were established through configuration changes. The lack of input validation on the frame type and payload size also reflects CWE-20 Improper Input Validation, allowing crafted packets to trigger unintended system behaviors.
Given that the Lantronix XPress-DR product series reached end-of-life and end-of-support in February 2025, traditional vendor patches are no longer available for these devices. Organizations relying on this hardware must implement compensating controls such as network segmentation to isolate affected devices from untrusted networks, restrict access to port 30718 using firewall rules if the protocol is not strictly required for operations, and conduct regular audits of configuration integrity through out-of-band management channels where possible. Migration to supported replacement hardware should be prioritized immediately to eliminate this risk vector entirely, as no further security updates will be issued by the vendor for these legacy systems.