CVE-2026-109439

{
  "etk_id": "ETK-2026-1611",
  "cve_id": "CVE-2026-109439",
  "display_id": "CVE-2026-109439",
  "ghsa_id": "GHSA-gpg6-w924-6c8v",
  "euvd_id": "EUVD-2026-101337",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated configuration access in XPress-DR firmware",
  "summary": "Lantronix XPress-DR and XPress-DR-I devices running firmware through 8.1.0.0 are affected. An attacker able to reach the UDP configuration service can read device settings and make persistent configuration changes without authentication. Exposure requires network access to UDP port 30718.",
  "mitigation": "Block or tightly restrict UDP port 30718 to trusted management hosts, and isolate affected devices from untrusted networks. Plan to replace end-of-support XPress-DR hardware, as no fixed version is recorded.",
  "vendor": "LANTRONIX",
  "product": "XPress-DR",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 8.1.0.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "XPress-DR",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 8.1.0.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "XPress-DR-I",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0062,
  "epss_percentile": 0.4891,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.489412466666668,
  "t0_at": "2026-10-14T16:45:49.338000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T16:45:49.338000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T16:45:49.338000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109439"
    }
  }
}