CVE-2026-104076
CriticalCVSS 9.1Summary
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 have a missing authentication vulnerability in unprotected REST API endpoints on port 8288. Remote unauthenticated attackers can read sensitive device information and modify device configuration, such as DNS settings, enabling man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.
Risk Assessment
The risk includes unauthorized access to sensitive network and configuration information, as well as the potential to control outbound traffic, which could compromise data integrity and overall infrastructure security.
Recommendation
Immediately upgrade the firmware to version 7.9 or later and restrict access to port 8288 to trusted networks only.
Other vulnerabilities in TVU Networks Receiver/Transceiver
Original NVD description (English source)
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS