Unauthenticated Configuration Vulnerability in Lantronix XPress-DR Series
CVE-2026-109439

9.3CRITICAL

Key Information:

Vendor

Lantronix

Status
Xpress-dr
Xpress-dr-i
Vendor
CVE Published:
14 October 2026

What is CVE-2026-109439?

The firmware of Lantronix XPress-DR and XPress-DR-I devices is susceptible to a missing authentication flaw. This vulnerability enables remote attackers to exploit an unauthenticated UDP configuration protocol, allowing them to read and modify device configurations through carefully crafted frames sent to port 30718. Specifically, attackers can send a type 0xF8 query to retrieve live configuration data and a type 0xFD frame to overwrite critical settings, including IP address and serial-channel forwarding records. This alteration persists even after a reboot, posing significant risks to device integrity and operational security.

Affected Version(s)

XPress-DR 0 <= 8.1.0.0

XPress-DR-I 0 <= 8.1.0.0

References

https://cdn.lantronix.com/wp-content/uploads/pdf/PCN-753-...
vendor-advisory
https://www.vulncheck.com/advisories/lantronix-xpress-dr-...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D6fault
.