---
id: CVE-2026-109439
title: >-
  Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0
  contains a missing authentication vulnerability that allows remote attackers
  to read and persistently overwrite device configuration by sending crafted
  frames to…
summary: >-
  Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0
  contains a missing authentication vulnerability that allows remote attackers
  to read and persistently overwrite device configuration by sending crafted
  frames to…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:18:23.253'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109439'
references:
  - url: >-
      https://cdn.lantronix.com/wp-content/uploads/pdf/PCN-753-Rev-B-EOL-Notice-XPRESS.pdf?xnotes__c=I%20am%20interested%20in%20the%20XPress%20DR%20/%20XPress%20DR-IAP.
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/lantronix-xpress-dr-unauthenticated-configuration-write-via-udp-30718
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T17:44:53.673Z'
---

## Overview

Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.