CVE-2026-109439

Executive Summary

CVE-2026-109439 is a critical missing authentication vulnerability (CWE-306) in Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through version 8.1.0.0. The vulnerability resides in the device's UDP configuration protocol on port 30718, which accepts crafted frames without requiring authentication, allowing a remote attacker to read live configuration data and persistently overwrite device configuration including IP address and serial-channel forwarding records. With a CVSS score of 9.8, this flaw enables full compromise of confidentiality and integrity of affected devices, and because changes commit to EEPROM, malicious modifications survive reboots.

Technical Analysis

The XPress-DR and XPress-DR-I are serial-to-Ethernet device servers built on the CoBos firmware family. The affected firmware exposes a UDP-based configuration and management protocol listening on port 30718. The core weakness is CWE-306 (Missing Authentication for Critical Function): the protocol accepts and processes configuration frames without validating any credential, session token, or source-authentication mechanism.

According to the NVD description, two specific frame types are abused:

• A type 0xF8 query returns live configuration data to the requester. This is a read primitive that leaks current device settings.
• A type 0xFD frame with exactly 0x78 body bytes is a write primitive. Successful processing rewrites the device IP address and serial-channel forwarding records.

Critically, the firmware commits these changes to EEPROM, meaning the modifications are persistent and survive device reboots. Because the protocol is unauthenticated and UDP-based, the attack surface is any network-reachable instance of the device on UDP/30718. There is no requirement for prior access, a valid account, or user interaction, consistent with the CVSS vector (PR:N, UI:N, AC:L).

The exact internal parsing routines, handler function names, and message layout beyond the two frame types identified in the description are not disclosed. No patch, CVE-linked commit, or vendor fix has been published. The product line reached end-of-life/end-of-support in February 2025, so no vendor remediation should be expected.

Exploitation Scenarios

No public PoC or exploit code is available; the following attack chain is inferred from the vulnerability class (unauthenticated UDP configuration protocol) and the specific frame types named in the NVD description.

1. Reconnaissance / target identification. An attacker scans UDP port 30718 across reachable network ranges to identify live CoBos-family XPress-DR/XPress-DR-I devices. Because the service responds to configuration queries, host discovery collapses to sending a probe frame and observing a reply.

2. Triggering the read primitive. The attacker sends a type 0xF8 query to UDP/30718. The unauthenticated protocol returns live configuration data, allowing the attacker to enumerate current device settings — including addressing and serial-forwarding context — before attempting modification.

3. Triggering the write primitive. The attacker crafts a type 0xFD frame with a body of exactly 0x78 (120) bytes and sends it to the device on UDP/30718. The firmware applies the frame without authentication, rewriting the device IP address and/or the serial-channel forwarding records.

4. Post-exploitation impact. The crafted changes are committed to EEPROM. The altered IP address can redirect or strand the device on the network, and modified serial-channel forwarding records can redirect serial traffic to attacker-chosen destinations. Because the modification is persistent, it survives reboots and is not cleared by power-cycling. Repeating the 0xFD write allows the attacker to overwrite configuration again at will.

No function names, endpoints, or parameters beyond those in the NVD description (port 30718, frame types 0xF8 and 0xFD, 0x78 body bytes) should be assumed.

Impact Assessment

Per the CVSS:3.1 vector (9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is remotely exploitable with no privileges and no user interaction, and has high impact on both confidentiality and integrity, with no impact on availability scored. Consequently:

• Confidentiality (High). The 0xF8 read primitive discloses live configuration data to any network-reachable requester.
• Integrity (High). The 0xFD write primitive allows persistent rewriting of IP addressing and serial-forwarding records, committing to EEPROM.
• Scope (Unchanged). Impact is confined to the vulnerable device component.

Business impact stems from the role of these devices: serial-to-Ethernet servers commonly bridge legacy industrial, medical, building-automation, and OT equipment. Persistent alteration of forwarding records can silently redirect or intercept serial traffic, while IP address changes can remove devices from management reach. Because modifications survive reboot, incident response based on restarting the device will not remediate the compromise. The blast radius is every network-reachable XPress-DR/XPress-DR-I device running firmware through 8.1.0.0, with elevated exposure for internet- or flat-LAN-exposed units on UDP/30718.

Detection Guidance

Sigma Rule

title: Unauthenticated UDP Configuration Writes to Lantronix XPress-DR (CVE-2026-109439)
id: 8f3c2a1e-1094-4cve-2026-109439
status: experimental
description: Detects network traffic characteristic of unauthenticated UDP/30718 configuration writes against Lantronix XPress-DR/XPress-DR-I firmware.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109439
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: zeek
detection:
  selection_port:
    dst_port: 30718
    protocol: udp
  selection_write_frame:
    # type 0xFD frame with 0x78-byte body per NVD description
    payload_type: 0xFD
  condition: selection_port and selection_write_frame
falsepositives:
  - Legitimate authorized device provisioning from management hosts
level: high
tags:
  - attack.t1190
  - cve.2026.109439

YARA Rule

rule CVE_2026_109439_XPress_DR_UDP_Config_Frame
{
    meta:
        description = "Detects UDP configuration frames abusing unauthenticated protocol on port 30718 (CVE-2026-109439)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109439"
        date = "2026-01-01"
    strings:
        $read_frame  = { F8 }
        $write_frame = { FD }
    condition:
        (uint16(2) == 0x77FE) or ($write_frame) or ($read_frame)
}

Note: the write frame body is exactly 0x78 bytes per the NVD description; YARA is best applied to captured PCAP payloads on port 30718.

Suricata IDS Rule

alert udp any any -> any 30718 (msg:"CVE-2026-109439 Lantronix XPress-DR unauthenticated UDP config frame"; content:"|FD|"; depth:0; byte_test:1,=,0x78,1; reference:cve,2026-109439; classtype:attempted-admin; sid:2026109439; rev:1;)
alert udp any any -> any 30718 (msg:"CVE-2026-109439 Lantronix XPress-DR config read query (0xF8)"; content:"|F8|"; depth:0; reference:cve,2026-109439; classtype:attempted-recon; sid:2026109440; rev:1;)

Elastic Detection

network where destination.port == 30718 and network.transport == "udp" and
  (data contains "0xFD" or data contains "0xF8")

Best paired with packet metadata: flag repeated 0xFD writes from a single source to multiple destinations on UDP/30718 as a mass-modification pattern.

Splunk SPL Query

index=network (dest_port=30718 OR dst_port=30718) transport=udp
| eval frame=upper(coalesce(payload_type, frame_type))
| where frame="FD" OR frame="F8"
| stats count values(frame) as frames dc(dest_ip) as targets by src_ip
| where count > 1 OR targets > 1
| sort - count

Wazuh OSSEC Rule

<group name="lantronix,cve-2026-109439,">
  <rule id="2026109" level="12">
    <decoded_as>json</decoded_as>
    <field name="dst_port">30718</field>
    <field name="protocol">udp</field>
    <description>CVE-2026-109439: Possible unauthenticated Lantronix XPress-DR UDP configuration write on port 30718</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Block UDP/30718 at network boundaries and between untrusted segments; the configuration protocol should not be reachable from untrusted networks.
   • Segment and firewall XPress-DR/XPress-DR-I devices so only authorized management hosts can reach them.
   • Where the protocol is not required, disable or block it entirely on adjacent infrastructure.
   • Monitor for anomalous 0xF8/0xFD traffic on UDP/30718 and for unexpected IP or forwarding-record changes on affected units.

2. Patch / upgrade steps

   • No vendor patch exists. The XPress-DR series reached end-of-life/end-of-support in February 2025, so firmware remediation is not expected.
   • Plan migration to a currently supported Lantronix device or an alternative serial-to-Ethernet product that does not expose an unauthenticated configuration protocol.

3. Long-term hardening

   • Inventory all legacy serial-to-Ethernet device servers and assign end-of-life hardware a defined retirement date.
   • Enforce network segmentation for OT/legacy serial infrastructure (no direct internet exposure, no flat management VLANs).
   • Apply least-privilege forwarding and static ACLs for serial-channel records where the device supports them.
   • Since EEPROM changes persist, treat any suspected compromise as requiring configuration restoration or hardware replacement, not a reboot.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109439
• Lantronix XPress-DR / XPress-DR-I product documentation and EOL/EOS notices (vendor site)
• CWE-306: Missing Authentication for Critical Function — https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (not yet scored) — https://www.first.org/epss/

No public exploit code, PoC, or Nuclei template is available, and CVE-2026-109439 is not listed in CISA KEV. No associated threat-actor campaign or in-the-wild exploitation evidence has been reported.