A missing authentication check in the UDP configuration protocol on port 30718 allows remote attackers to query and persistently alter device settings. Attackers can read complete live configuration data and overwrite the device’s IP address and serial‑channel forwarding records by sending specially crafted frames. The flaw, classified as CWE‑306, can lead to unauthorized changes that survive reboots, potentially rendering the device unreachable, misconfigured, or vulnerable to further attacks. Because the device firmware runs on legacy hardware that reached end‑of‑life in February 2025, there is a high risk that deployed units remain unpatched for long periods.

The vulnerability affects Lantronix XPress‑DR and XPress‑DR‑I devices running firmware version 8.1.0.0 or earlier. These products belong to the CoBos family and are typically used in industrial or industrial‑control settings. The entire XPress‑DR product line is no longer supported as of February 2025, meaning no official updates are guaranteed for affected units.

With a CVSS score of 9.3 the flaw is classified as critical. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but its high intrinsic severity and the lack of authentication mean an attacker can exploit it from any network that can reach the device’s UDP port 30718. The likely attack vector is unsanctioned traffic over the network to the unauthenticated UDP configuration port, where the attacker sends a type 0xF8 query to read and a type 0xFD frame with a 0x78‑byte body to rewrite configuration values. The impact of successful exploitation includes persistent misconfiguration, loss of network access, and exposure to further compromises.