Xpress Dr
Monthly
Lantronix XPress-DR and XPress-DR-I (CoBos-family) devices running firmware through 8.1.0.0 expose an unauthenticated UDP configuration service on port 30718 that lets any remote attacker who can reach that port read live configuration data with a type 0xF8 query and persistently rewrite the device IP address and serial-channel forwarding records using a type 0xFD frame with an exactly 0x78-byte body, with the changes committed to EEPROM and surviving reboots. The root cause is missing authentication for a critical function (CWE-306), and no credentials, user interaction, or non-default settings are required; the only practical barriers are network reachability of UDP/30718 and the shrinking installed base after the series reached end-of-life in February 2025. The CVE record scores this 9.3 under CVSS 4.0 and our independent assessment rates it 9.8 under CVSS 3.1; no public exploit code or confirmed active exploitation was identified at time of analysis, though the attack itself is trivial to perform against any reachable device.
Lantronix XPress-DR and XPress-DR-I (CoBos-family) devices running firmware through 8.1.0.0 expose an unauthenticated UDP configuration service on port 30718 that lets any remote attacker who can reach that port read live configuration data with a type 0xF8 query and persistently rewrite the device IP address and serial-channel forwarding records using a type 0xFD frame with an exactly 0x78-byte body, with the changes committed to EEPROM and surviving reboots. The root cause is missing authentication for a critical function (CWE-306), and no credentials, user interaction, or non-default settings are required; the only practical barriers are network reachability of UDP/30718 and the shrinking installed base after the series reached end-of-life in February 2025. The CVE record scores this 9.3 under CVSS 4.0 and our independent assessment rates it 9.8 under CVSS 3.1; no public exploit code or confirmed active exploitation was identified at time of analysis, though the attack itself is trivial to perform against any reachable device.