TVU Receiver Devices Expose Unauthenticated API Allowing Remote Config Changes

TVU Networks Receiver and Transceiver devices running firmware versions prior to 7.9 contain a critical missing authentication vulnerability that allows remote attackers to access sensitive information and modify device configurations. The flaw, identified as CVE-2026-104076, exposes unprotected REST API endpoints on port 8288 to unauthenticated users.

The vulnerability carries a CVSS score of 9.3, classified as Critical by the National Vulnerability Database. It stems from CWE-306, which denotes missing authentication for critical functionality. Because the API endpoints lack any form of credential verification, any individual with network access to the device can interact with the system directly. This includes both reading sensitive data and writing changes to the device’s operational parameters.

Technical Details and Attack Vector

Attackers can exploit this vulnerability using standard HTTP requests. By sending unauthenticated GET requests to the exposed endpoints, adversaries can disclose detailed network configuration data, specific firmware versions, and information regarding cloud service connections. This reconnaissance capability provides attackers with a clear map of the device’s integration within the broader network infrastructure.

More severely, the flaw allows for active manipulation of the device. Attackers can issue POST requests to specific endpoints, such as /Setting3/API/API/v1/LocalNetwork/DNS. This capability enables them to alter the device’s DNS settings. By changing these settings, an attacker can redirect outbound connections intended for TVU cloud infrastructure to malicious servers. This redirection facilitates man-in-the-middle attacks, potentially allowing the interception or modification of data in transit between the device and the cloud services.

Affected Products and Scope

The vulnerability affects TVU Networks Receiver and Transceiver hardware. Specifically, any unit running firmware versions earlier than 7.9 is vulnerable. TVU Networks devices are commonly used in live video production and broadcast environments, where reliable and secure connectivity to cloud infrastructure is essential for remote production workflows.

The impact of this vulnerability is significant due to the critical nature of the affected functionality. Compromised DNS settings can disrupt legitimate operations and compromise the integrity of data transmissions. Furthermore, the exposure of network configuration details can aid attackers in planning further intrusions into the surrounding network environment.

What should you do?

Organizations using TVU Networks hardware should immediately audit their device firmware versions. Any device running a version prior to 7.9 should be updated to the latest available firmware to patch the missing authentication flaw. Until updates are applied, network administrators should consider restricting access to port 8288 through firewall rules or network segmentation to prevent unauthenticated external access. Monitoring logs for unexpected configuration changes, particularly to DNS settings, can help detect exploitation attempts.