Description

Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T17:18:23.253Z",
  "pubdate": "2026-10-14T17:18:23.253Z",
  "executiveSummary": "The Lantronix XPress-DR and XPress-DR-I device series, running CoBos-family firmware up to version 8.1.0.0, are susceptible to a critical missing authentication vulnerability within their UDP configuration protocol on port 30718.\nThis flaw enables unauthenticated remote attackers to bypass security controls to read sensitive device configuration data and persistently modify device settings, including network IP configurations and serial-channel forwarding records.\nBy transmitting specially crafted frames, an attacker can force the device to commit malicious modifications to the EEPROM, ensuring changes persist across power cycles and reboots.\nThe vulnerability represents a significant risk to device integrity and network security, as it allows for unauthorized control over communication parameters without requiring prior authentication.\nGiven that the XPress-DR product series reached its end-of-life and end-of-support status in February 2025, no official vendor patches will be provided, leaving legacy deployments permanently exposed to potential exploitation.",
  "technicalDetails": "The vulnerability resides in the implementation of the proprietary configuration protocol utilized by the CoBos firmware, which listens on UDP port 30718. The root cause is a complete lack of authentication mechanisms for commands processed by this service.\nExploitation is achieved through the injection of crafted UDP frames, which the device processes without verifying the sender's identity or authorization status. Attackers can leverage specific frame types to manipulate the device's operational state.\nThe attack flow for information disclosure involves sending a type 0xF8 frame to the target device. Upon receipt of this frame, the device responds with its current configuration data, allowing an attacker to map the device's internal settings and network topology.\nFor unauthorized configuration modification, an attacker must send a type 0xFD frame. This frame must contain exactly 0x78 bytes in the body to be accepted by the vulnerable parsing logic. Successful delivery of this payload triggers an immediate update to the device's internal configuration parameters, specifically targeting the IP address assignment and serial-channel forwarding records.\nA critical aspect of this vulnerability is the persistence mechanism; the device automatically commits these configuration changes to the non-volatile EEPROM memory. Consequently, malicious modifications survive device reboots, effectively providing an attacker with a permanent foothold to redirect serial traffic or isolate the device from the network.\nThe vulnerability is exposed at the network level, as the configuration protocol does not require proximity to the device, provided the UDP port 30718 is reachable from the attacker's network segment. No specific privileges are required for interaction, as the service is designed to be accessible to management tools, but it lacks the necessary access control lists or cryptographic validation to prevent malicious interaction by unauthorized entities.\nAffected firmware versions include all versions of the CoBos-family firmware up to and including 8.1.0.0 for both XPress-DR and XPress-DR-I hardware. Since the product has reached end-of-support, the vulnerability cannot be remediated through standard vendor-provided updates."
}