Lantronix XPress-DR Firmware Allows Remote Config Overwrite Without Authentication
Attackers can rewrite IP addresses and forwarding records on Lantronix serial devices by sending unauthenticated UDP packets to a specific port.
Key points
- The flaw affects Lantronix XPress-DR and XPress-DR-I firmware versions through 8.1.0.0.
- A CVSS score of 9.3 rates the missing authentication vulnerability as critical severity.
- The product series reached end-of-life status in February 2025, with no further support.
Remote attackers can permanently alter the configuration of Lantronix XPress-DR and XPress-DR-I devices without providing any credentials. According to the National Vulnerability Database record for CVE-2026-109439, the vulnerability allows adversaries to read live settings and overwrite critical network parameters. This capability enables attackers to redirect serial channel traffic and change the device IP address. The changes persist in EEPROM memory, meaning the malicious configuration remains active even after the device reboots.
In plain English
The Lantronix XPress-DR series devices use a UDP protocol on port 30718 to handle configuration updates. The system does not require a password or token to process these requests. An attacker can send a specific query frame to retrieve the current device settings. They can then send a different frame containing new data to rewrite the IP address and forwarding records. The device accepts this new data as legitimate and saves it to permanent storage. This means the attacker can effectively take control of the device's network identity and traffic routing without triggering any login alerts.
The background
The affected hardware belongs to the CoBos-family of serial-to-IP converters. The vulnerability exists in firmware versions up to and including 8.1.0.0. Lantronix declared the XPress-DR product series as end-of-life and end-of-support in February 2025. This status indicates that the vendor will not release security patches or updates for these devices. The flaw is classified under CWE-306, which covers missing authentication for critical functions. The high severity rating reflects the ease of exploitation and the potential for persistent network disruption.
What changes now
Security teams managing legacy infrastructure must reassess the risk profile of these devices. Since no vendor support exists, organizations cannot rely on official patches to remediate the issue. The ability to rewrite IP addresses remotely can lead to man-in-the-middle attacks or denial of service conditions. Operators should verify if these devices are accessible from untrusted networks. Isolating the devices or removing them from production environments may be necessary to mitigate the risk. The lack of authentication makes this a straightforward target for automated scanning tools.
What made it possible
Unauthenticated configuration interfaces expose devices to direct manipulation by any network participant. This weakness typically serves the initial access stage of an intrusion, allowing attackers to establish footholds without bypassing security controls. Teams usually monitor for unexpected changes in device identity or traffic patterns. Check whether legacy protocols remain enabled on segments that should be restricted. Ensure that network segmentation prevents external access to management ports. Verify that audit logs capture configuration change events for forensic analysis.
What to do and how to stay safe: Lantronix
- Audit network scans to identify any Lantronix XPress-DR devices listening on UDP port 30718.
- Implement strict firewall rules to block external access to this port from untrusted networks.
- Monitor device logs for unexpected IP address changes or configuration updates without local admin action.
- Plan for hardware replacement since the vendor has ended support for this product line.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific devices are affected by this vulnerability?
Lantronix XPress-DR and XPress-DR-I devices running firmware version 8.1.0.0 or earlier are affected.
Is there a patch available for CVE-2026-109439?
No fix has been confirmed yet, as the product series reached end-of-life in February 2025.
How do attackers exploit this missing authentication flaw?
Attackers send crafted UDP frames to port 30718 to read and overwrite configuration data without credentials.
