External risk intelligence

Lantronix XPress-DR Missing Authentication Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-109439

The vulnerability involves an unauthenticated UDP protocol on port 30718 used for device configuration. Lantronix XPress-DR devices are serial-to-Ethernet gateways often deployed to provide network access to industrial or legacy equipment. While such devices are intended to be managed internally, they are frequently placed at the network edge or directly exposed to facilitate remote connectivity for serial devices.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Lantronix XPress-DR devices, a type of hardware used for network connectivity. A flaw in the device's configuration protocol allows unauthenticated attackers to read and change critical settings remotely. While the specific product series is end-of-life, understanding potential exposure remains important.

Unauthenticated attackers can alter device configuration remotely.
Leadership should remember this to confirm system relevance and exposure.
Verify if this end-of-life product is still in use.

Attack Path

How an attacker could exploit the issue

An attacker can remotely reach vulnerable Lantronix devices exposed to the internet and manipulate their configuration without needing any credentials. This is achieved by sending specially crafted data over an unauthenticated UDP protocol, allowing the attacker to read or rewrite critical device settings like IP addresses and forwarding records. The vulnerability can lead to persistent changes that survive device reboots, potentially disrupting network connectivity or redirecting sensitive traffic.

Unauthenticated UDP access required.
Crafted frames to configuration protocol.
Persistent device configuration overwrite.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to read and overwrite device configuration data on Lantronix XPress-DR devices when they are accessible over a network. This could impact the device's network settings and serial-to-Ethernet forwarding configurations, potentially disrupting connectivity for attached serial devices.

Device configuration data.
Unauthenticated UDP protocol access.
Disrupted serial device connectivity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Lantronix XPress-DR product series, now end-of-life, is susceptible to a critical missing authentication vulnerability allowing remote attackers to read and overwrite device configurations. Given the end-of-support status, immediate inventory and risk assessment are crucial for any remaining devices, with potential coordination with vendor management for any available residual support or mitigation guidance.

Identify affected devices and owners.
Verify exposure and business criticality.
Plan for end-of-life mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Lantronix XPress-DR series?

These devices are specialized serial-to-Ethernet gateways designed to bridge legacy industrial equipment or serial hardware onto modern network infrastructures. By converting serial data streams into network packets, they allow remote communication with devices that lack native Ethernet capabilities. They are typically used in environments where connectivity for older sensors, controllers, or industrial machines is required over IP networks.

What does the missing authentication weakness mean for CVE-2026-109439?

This vulnerability, classified as CWE-306, means the device's management interface lacks any security gatekeeper. Because the UDP configuration protocol on port 30718 does not verify the identity of the person sending commands, it treats any incoming request as legitimate. This allows an unauthorized user to bypass normal security controls and issue sensitive administrative commands directly to the hardware.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially formatted UDP packets to port 30718. The device responds to specific frame types—like 0xF8 for reading and 0xFD for writing—without requiring a password or prior session. It is important to note that sending generic, malformed, or random data does not trigger this; the attacker must use these specific, documented frame structures to successfully modify the device's persistent configuration.

Why should I care about this if I use these devices internally?

Halo Surface Signal notes that while these gateways are intended for internal management, they are frequently placed at the network edge to support remote serial connectivity. If your device is accessible from the internet, it is at high risk of unauthorized configuration changes. Even if internal, any compromised machine on your network could potentially send these UDP frames to the device, leading to traffic redirection or service disruption.

Do I need to patch my Lantronix XPress-DR devices?

Since this product series reached its end-of-life in February 2025, official security updates or patches from the vendor are not available. Your primary action is to inventory all remaining units to determine their physical location and network role. Once identified, you should restrict network access to port 30718 using firewalls or VLANs, and prioritize replacing these unsupported devices with current, vendor-supported hardware.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.