CVE-2026-109439 is a critical missing-authentication vulnerability (CVSS 9.8) in end-of-life Lantronix XPress-DR and XPress-DR-I firmware. It lets remote attackers read a device's configuration and overwrite it persistently.
What Is It
CVE-2026-109439 is a missing-authentication flaw (CWE-306) in the CoBos-family firmware of Lantronix XPress-DR and XPress-DR-I devices. The device's UDP configuration protocol on port 30718 accepts frames without authentication. According to the NVD record:
- A type 0xF8 query returns live configuration data.
- A type 0xFD frame with exactly 0x78 body bytes rewrites the device IP address and serial-channel forwarding records.
Changes made this way are committed to EEPROM, so they survive a reboot. VulnCheck reported the vulnerability, and NVD published it on October 14, 2026. The NVD status is currently "Received."
Why It Matters
The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) means an attacker can exploit this over the network with low complexity, no privileges, and no user interaction. Confidentiality, integrity, and availability impacts are all rated High. The CVSS 4.0 score is 9.3 (Critical).
An attacker who can reach UDP/30718 can:
- read the device's configuration
- change its IP address, which can take it off the network
- redirect where serial data is forwarded
Because the changes are written to EEPROM, rebooting the device does not undo them.
The cited sources do not confirm any active exploitation. Defenders should check the CISA Known Exploited Vulnerabilities (KEV) catalog directly for this CVE's current status.
What's Vulnerable
- Lantronix XPress-DR: firmware through 8.1.0.0
- Lantronix XPress-DR-I: firmware through 8.1.0.0
The CVE carries the tag "unsupported-when-assigned." The XPress-DR product series reached end-of-life/end-of-support in February 2025.
Patch Status
The cited sources do not list a vendor patch or fixed firmware version. The product line was already end-of-life when the CVE was assigned, and the vendor reference is an EOL notice rather than a security fix. Organizations still running these devices should check the VulnCheck advisory and the Lantronix EOL notice for guidance.