XPress-DR (<= 8.1.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xpress-dr--8.1.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 14 Oct 2026 20:32:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in Lantronix CoBos Firmwarehttps://feed.craftedsignal.io/briefs/2026-10-lantronix-cobos-auth-bypass/Wed, 14 Oct 2026 20:32:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-lantronix-cobos-auth-bypass/Lantronix XPress-DR and XPress-DR-I devices running firmware version 8.1.0.0 and earlier are vulnerable to remote configuration manipulation via an unauthenticated UDP configuration protocol.Lantronix XPress-DR and XPress-DR-I devices utilizing the CoBos firmware family up to version 8.1.0.0 contain a critical missing authentication vulnerability (CVE-2026-109439). This flaw permits remote, unauthenticated attackers to interact with the device configuration protocol over UDP port 30718. By sending crafted frames, an attacker can extract sensitive configuration data or gain persistent unauthorized control over the device settings. Specifically, the vulnerability allows attackers to overwrite critical parameters such as the device IP address and serial-channel forwarding records. These changes are committed to the device EEPROM, ensuring persistence across reboots. Given that the XPress-DR product line reached end-of-life status in February 2025, no official security patches will be issued by the vendor to remediate this flaw.

Impact

The vulnerability poses a severe risk of unauthorized network access and persistent device compromise. Because the device handles serial-channel forwarding, successful exploitation allows attackers to intercept or redirect serial communications, potentially leading to unauthorized control of industrial or networked equipment managed by the affected Lantronix modules. As the product is no longer supported, users must implement network-level controls to isolate these devices from untrusted network segments.

Recommendation

  • Isolate all Lantronix XPress-DR and XPress-DR-I devices from the public internet by ensuring they are not reachable via UDP port 30718 from untrusted networks.
  • Configure perimeter firewalls or ACLs to restrict access to port 30718 (UDP) to only known, authorized management subnets.
  • Since the affected products have reached end-of-life as of February 2025, plan for the immediate decommissioning and replacement of these devices with currently supported hardware.
]]>criticaladvisoryindustrial-control-systemsnetwork-securityembedded-devices