Lantronix XPress-DR CVE-2026-109439

No special conditions beyond network reachability - remote unauthenticated exploitation against default configurations of Lantronix XPress-DR/XPress-DR-I devices, which expose the configuration protocol on UDP port 30718 with no authentication (CWE-306). The only real limiting factors are network exposure (the attacker must be able to send UDP to port 30718, so segmentation or firewalling of this management port blocks it) and the shrinking installed base following the February 2025 end-of-life. The read primitive requires a type 0xF8 query; the persistent-write primitive requires a type 0xFD frame with exactly 0x78 body bytes. No authentication, no user interaction, and no non-default setting is needed.

This is a genuine high-priority issue for any environment still running these devices, tempered by a narrow deployment footprint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, scored 9.3) aligns cleanly with the description: a remote, unauthenticated attacker over the network can both read (type 0xF8) and persistently rewrite (type 0xFD) device configuration via UDP/30718, with no user interaction and low complexity - all signals point the same direction with no internal contradiction. The attack is network-reachable and trivially automatable against any exposed device. The mitigating factors are not in the CVSS score but in the ecosystem: no EPSS score, no CISA KEV listing, and no public exploit were provided, and the XPress-DR series reached end-of-life/end-of-support in February 2025, so the real-world exploited-at-scale risk is constrained by how many units remain deployed and internet- or network-exposed rather than by exploit difficulty. EOL status is a double-edged signal - it bounds prevalence but also means no vendor patch will be issued, so exposed devices stay vulnerable indefinitely. Treat as a high priority where these units exist and are reachable; deprioritize only after confirming none are deployed.

An attacker with network reachability to an XPress-DR/XPress-DR-I device sends a crafted type 0xF8 UDP datagram to port 30718 to enumerate the live configuration, then sends a type 0xFD frame with exactly 0x78 body bytes to overwrite the device IP address and serial-channel forwarding records. The changes commit to EEPROM and survive reboots, letting the attacker redirect serial traffic or knock the device off the network without any credentials. No public exploit was provided, but the protocol details disclosed in the advisory make reproduction straightforward.