Is CVE-2026-109439 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109439 being exploited in the wild.

How severe is CVE-2026-109439?

Critical severity, with a CVSS score of 9.8, published 14 October 2026.

Which products and versions are affected?

Lantronix XPress-DR through 8.1.0.0; Lantronix XPress-DR-I through 8.1.0.0.

How is CVE-2026-109439 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-109439?

Check whether you run Lantronix XPress-DR or Lantronix XPress-DR-I at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109439: Lantronix XPress-DR authentication bypass in UDP configuration protocol

CVE-2026-109439 · Severity: critical · CVSS 9.8 · Published 2026-10-14

Lantronix XPress-DR and XPress-DR-I are network terminal servers that manage remote device connectivity and configuration. A missing authentication vulnerability on UDP port 30718 allows unauthenticated attackers to read live configuration data and persistently modify device settings such as IP addresses and serial forwarding rules. An attacker can change device configuration without credentials, potentially redirecting traffic, gaining access to connected systems, or causing operational disruption that survives device reboots.

Vendors: Lantronix.

Quick answers

Is CVE-2026-109439 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109439 being exploited in the wild.
How severe is CVE-2026-109439?: Critical severity, with a CVSS score of 9.8, published 14 October 2026.
Which products and versions are affected?: Lantronix XPress-DR through 8.1.0.0; Lantronix XPress-DR-I through 8.1.0.0.
Is there a fix for CVE-2026-109439?: No fixed version is recorded yet. Restrict UDP port 30718 access at the network perimeter to trusted management networks only. The XPress-DR product series reached end-of-life in February 2025; migrate to a supported terminal server product. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109439 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-109439?: Check whether you run Lantronix XPress-DR or Lantronix XPress-DR-I at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict UDP port 30718 access at the network perimeter to trusted management networks only. The XPress-DR product series reached end-of-life in February 2025; migrate to a supported terminal server product.

Technical details

The vulnerability is a missing authentication control (CWE-306) on the UDP configuration protocol listening on port 30718. An attacker can send type 0xF8 frames to read configuration and type 0xFD frames with 0x78-byte bodies to modify IP addresses and serial-channel forwarding; changes are committed to EEPROM and persist across reboots. No authentication or user interaction is required; the attack is network-accessible and trivial to exploit with crafted UDP frames.

Affected products

Lantronix XPress-DR through 8.1.0.0
Lantronix XPress-DR-I through 8.1.0.0

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.