---
title: Hunt: Lantronix XPress-DR UDP/30718 config protocol (CVE-2026-109439) | ctxsec
url: https://ctxsec.com/items/hunt-lantronix-udp-30718
description: ""
status: "hunt idea (from CVE description)"
published: 2026-10-15
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-lantronix-udp-30718.md)

hunt idea (from CVE description)

2026-10-15

### Hunt: Lantronix XPress-DR UDP/30718 config protocol (CVE-2026-109439)

Find serial-device servers still advertising UDP/30718 (0x77FE). Flag any 0xF8 (config read) or 0xFD (0x78-byte config write) frames from non-management hosts, and correlate with sudden IP/gateway or serial-forwarding changes on OT jump paths. Prefer network ACLs that deny 30718/udp at the plant boundary; confirm the device Security option that disables port 77FEh is set where the UI still exists. Replace EOL XPress-DR/XPress-DR-I units rather than long-term compensating controls.

Sources: [CVE-2026-109439](https://www.cve.org/CVERecord?id=CVE-2026-109439)