---
title: Lantronix XPress-DR CVE-2026-109439: unauthenticated UDP/30718 config read/write on EOL serial servers | ctxsec
url: https://ctxsec.com/items/lantronix-xpress-dr-cve-2026-109439
description: ""
status: "confirmed (CVE); product EOL; not on CISA KEV"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/lantronix-xpress-dr-cve-2026-109439.md)

confirmed (CVE); product EOL; not on CISA KEV

2026-10-14

### Lantronix XPress-DR CVE-2026-109439: unauthenticated UDP/30718 config read/write on EOL serial servers

CVE-2026-109439 (CVSS 4.0 9.3, CWE-306) affects Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0. The unauthenticated UDP configuration protocol on port 30718 (0x77FE) accepts a type 0xF8 query to read live configuration and a type 0xFD frame with exactly 0x78 body bytes to persistently rewrite device IP and serial-channel forwarding records to EEPROM across reboots. The XPress-DR line reached end-of-life/end-of-support in February 2025, so replace exposed units. Until then, disable UDP/30718 via the device Security option that turns off port 77FEh, or block the port at the network boundary. Credit: D6fault. Not on CISA KEV as of catalogVersion 2026.10.14.

Sources: [CVE-2026-109439](https://www.cve.org/CVERecord?id=CVE-2026-109439) · [VulnCheck advisory summary](https://www.vulncheck.com/advisories/lantronix-xpress-dr-unauthenticated-configuration-write-via-udp-30718)