Summary
generated automatically from NVD dataLantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 lacks authentication on its UDP configuration protocol, listening on port 30718. Remote attackers can send crafted frames to read the live configuration (type 0xF8 query) and to rewrite the device IP address and serial-channel forwarding records (type 0xFD frame), with changes committed to EEPROM so they persist across reboots. The XPress-DR series reached end-of-life in February 2025; the flaw is rated CRITICAL with a CVSS v3.1 score of 9.8 (CWE-306).
NVD description
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.
EPSS · FIRST.org
0.62%probability of exploitation in the next 30 days
Higher than 48% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 14 oct. 2026
- Updated
- 16 oct. 2026
- Status
- Awaiting Analysis
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-306
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.