TVU Networks Devices Have Critical Auth Bypass Vulnerability
Remote attackers can gain full admin control of TVU Receiver and Transceiver devices by bypassing login checks, according to new NVD data.
Key points
- CVE-2026-104075 allows unauthenticated remote access to TVU management interfaces.
- The flaw exists in firmware versions prior to 7.9 for Receiver and Transceiver models.
- Attackers bypass authentication by submitting empty or absent username parameters.
TVU Networks Receiver and Transceiver devices contain a critical authentication bypass vulnerability that allows remote attackers to gain full administrative control. The flaw, identified as CVE-2026-104075, affects devices running firmware versions earlier than 7.9.
At a glance
- CVE
- CVE-2026-104075
- Product
- TVU Receiver / Transceiver
- CVSS
- 9.3 Critical
- Weakness
- authentication bypass
- Exploited
- No known exploitation
The vulnerability is rated Critical with a CVSS score of 9.3. It resides in the web management login endpoint, specifically the POST /tvu/Login path. An attacker does not need valid credentials to exploit this issue. By sending a crafted HTTP request that omits the UserName parameter or leaves it empty, the attacker bypasses the required authentication step. This method circumvents client-side JavaScript validation that would normally prevent such requests. The server responds with a valid session cookie regardless of the password value provided, granting the attacker immediate access to the administrative interface.
Technical Context
The weakness is classified under CWE-288, which relates to authentication issues. The core problem is that the server-side logic fails to properly validate the presence of the username field during the login process. While the web interface may use JavaScript to enforce input rules, these checks are not sufficient for security because they can be bypassed by direct HTTP requests. Once the attacker obtains the session cookie, they have complete control over the device's web management features. This level of access allows for configuration changes, data interception, or further lateral movement within the network.
Affected Products
The vulnerability impacts TVU Networks hardware specifically identified as TVU Receiver and TVU Transceiver units. The risk applies only to devices operating on firmware versions before 7.9. Organizations using these models for video transmission and reception should verify their current firmware levels immediately. If the firmware version is below 7.9, the device is susceptible to this remote exploit.
What should you do?
Security teams should audit their network for exposed TVU Receiver and Transceiver devices. Check the firmware version on each unit to determine if it is prior to version
What to do and how to stay safe
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
