CVE-2026-104075
CriticalCVSS 9.8Summary
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 have an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login. Submitting an empty or absent UserName parameter allows obtaining a valid administrative session without knowing the password, bypassing client-side JavaScript validation.
Risk Assessment
An attacker can gain full administrative control over the device's web management interface, enabling configuration changes, data theft, or further network attacks.
Recommendation
Immediately upgrade the firmware to version 7.9 or later and implement additional authentication mechanisms such as VPN or restricted access to the management interface.
Other vulnerabilities in TVU Networks Receiver/Transceiver
Original NVD description (English source)
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS