Unauthenticated Remote Authentication Bypass in Lantronix XPress-DR Rates 9.8 CVSS
Last refreshed2026-10-15
Status: UPDATED
| Advisory ID: CVE-2026-109439
Key Details
CVE
CVE-2026-109439
CVSS Score / Version
9.8 (Critical) / CVSS v3.1
Updated
2026-10-14
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Prose
attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Lantronix XPress-DR and Lantronix XPress-DR-I
Classified as
CWE-306 (Missing Authentication for Critical Function)
Exploitation prediction (EPSS)
0.62% probability of exploitation in the next 30 days (48% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Lantronix
XPress-DR
Lantronix
XPress-DR-I
Subsystems
General OT
Sectors
Multiple
What to Know
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025. (NVD)
What to Do
Monitor Lantronix's web page for any future patch releases.