CVE-2026-104075

Deferred Deferred - Pending Action

Authentication Bypass in TVU Networks Receiver/Transceiver Firmware

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-104075

EUVD

EUVD-2026-95250

Affected Vendors & Products

Vendor	Product	Version / Range
TVU	Networks	TVU Receiver / Transceiver 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass flaw in TVU Networks Receiver/Transceiver devices running firmware before version 7.9. It allows remote unauthenticated attackers to gain administrative access by sending a crafted HTTP POST request to the /tvu/Login endpoint with an empty or missing UserName parameter. The attack bypasses client-side JavaScript validation, enabling attackers to receive a valid session cookie regardless of the password value, thus granting full control over the device's web management interface.

Detection Guidance

To detect this vulnerability, scan your network for devices running TVU Networks Receiver/Transceiver firmware versions before 7.9. Check if the /tvu/Login endpoint is accessible and test if sending an empty UserName parameter in a POST request returns a valid session cookie without authentication.

Impact Analysis

This vulnerability allows attackers to gain full administrative control of the device's web management interface without needing valid credentials. This could lead to unauthorized access, configuration changes, data theft, or disruption of services relying on the affected TVU devices.

Compliance Impact

This vulnerability allows unauthenticated remote attackers to gain full administrative control of TVU Networks devices, which could lead to unauthorized access to sensitive data. Such access may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by exposing personal or protected health information without proper authentication.

Mitigation Strategies

Immediately update TVU Networks Receiver/Transceiver devices to firmware version 7.9 or later to patch the authentication bypass vulnerability. If immediate updating is not possible, restrict network access to the web management interface or disable it entirely until the update is applied.

Hi! I’m here to help you understand CVE-2026-104075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70