Critical CVE-2026-109439 Lets Attackers Rewrite Lantronix XPress-DR Configs

A security flaw in older Lantronix networking devices allows anyone on the network to change how the device operates without needing a password. This vulnerability, tracked as CVE-2026-109439, affects the XPress-DR and XPress-DR-I hardware models that are no longer supported by the manufacturer. The issue is rated as critical because it enables remote attackers to take control of device settings permanently.

How it unfolded

• The National Vulnerability Database recorded CVE-2026-109439 with a CVSS score of 9.3, classifying the severity as critical.
• The flaw stems from a missing authentication mechanism in the firmware versions up to and including 8.1.0.0 for the CoBos-family devices.
• Lantronix declared the XPress-DR product series end-of-life and end-of-support in February 2025, meaning no further patches are expected.

Who is affected

System administrators managing Lantronix XPress-DR or XPress-DR-I devices are exposed to this risk if they are running firmware version 8.1.0.0 or earlier. The vulnerability impacts the CoBos-family of products specifically. Since the device line reached end-of-support in February 2025, organizations using these units are operating without vendor security updates. The flaw allows remote attackers to interact with the device configuration protocol without any form of login or credential verification.

What happens next

Attackers can exploit this weakness by sending specific network frames to the device. By targeting the unauthenticated UDP configuration protocol on port 30718, a remote user can first read the current live configuration data. This is done by sending a query frame type 0xF8. After reading the settings, the attacker can then overwrite them. They send a frame type 0xFD containing exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records. These changes are committed to the device’s EEPROM memory, meaning the malicious configuration persists even after the device is rebooted. No fix has been confirmed yet because the product is end-of-life.

The background in plain language

This story involves three key concepts. First, missing authentication means a system accepts commands without verifying the user’s identity, like a door with no lock. Second, UDP is a fast but less secure way to send data over networks, often used for simple device controls. Third, EEPROM is a type of memory that retains settings even when power is cut. When a flaw allows changes to be written to EEPROM without a password, an attacker can permanently alter how the device behaves, such as changing its network address, making it difficult to regain control.

What to do and how to stay safe: Lantronix

• Audit your network inventory to identify any Lantronix XPress-DR or XPress-DR-I devices running firmware 8.1.0.0 or older.
• Check firewall rules to ensure port 30718 is blocked from untrusted networks, preventing external access to the configuration protocol.
• Monitor network traffic for unusual UDP activity on port 30718, which could indicate an attempt to read or modify device settings.
• Plan to replace end-of-life hardware with supported alternatives, as no security patches are available for this discontinued product line.

General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109439?

The National Vulnerability Database rates CVE-2026-109439 with a CVSS score of 9.3, which is classified as critical.

Which Lantronix devices are affected by this vulnerability?

Lantronix XPress-DR and XPress-DR-I devices running firmware through version 8.1.0.0 are affected by this missing authentication flaw.

Is there a patch available for this vulnerability?

No fix has been confirmed yet, as the XPress-DR product series reached end-of-life and end-of-support in February 2025.