Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware — CVE-2026-109439 (Critical)

Date Oct 14, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Lantronix · XPress-DR and XPress-DR-I (CoBos-family) firmware

CVE CVE-2026-109439

Critical vendor advisory CVE-2026-109439

Summary

Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware. Patch or mitigate promptly. EPSS percentile: 48%.

Operator check

Review CVE-2026-109439 in your asset inventory. Apply patches per vendor guidance and verify XPress-DR and XPress-DR-I (CoBos-family) firmware is not exposed. CVSS score: 9.8. EPSS probability: 0.6%; percentile: 48%.

Sources

NVD — CVE-2026-109439 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed