CVE-2026-104076
Deferred Deferred - Pending Action

Unauthenticated REST API Access in TVU Networks Receiver/Transceiver

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-09
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-104076
EUVD
EUVD-2026-95251

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TVU Networks TVU Receiver / Transceiver 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication flaw in TVU Networks Receiver/Transceiver devices running firmware before version 7.9. It allows remote attackers to access and modify sensitive device information without authentication via unprotected REST API endpoints on port 8288. Attackers can retrieve network configuration, firmware details, and cloud service information using GET requests or alter DNS settings and perform man-in-the-middle attacks using POST requests.

Detection Guidance

Check if port 8288 is open on TVU devices by running a port scan like 'nmap -p 8288 <device_IP>'. If open, test unauthenticated access by sending a GET request to the REST API endpoint, e.g., 'curl http://<device_IP>:8288/Setting3/API/API/v1/LocalNetwork/DNS'.

Impact Analysis

This vulnerability can allow attackers to read sensitive device information, modify device configurations, and intercept outbound connections to TVU's cloud infrastructure. This could lead to unauthorized access to network data, DNS spoofing, and potential man-in-the-middle attacks on communications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR and HIPAA. Exposure of network configuration and cloud service information could result in data breaches, impacting confidentiality and integrity of personal or health information.

Mitigation Strategies

Upgrade TVU devices to firmware version 7.9 or later immediately. If upgrading is not possible, restrict access to port 8288 via firewall rules to prevent unauthenticated access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104076. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart