CVE-2026-104076

CRITICAL 9.1

TVU Networks Receiver/Transceiver Missing Authentication via REST API

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.

CWE	CWE-306
Vendor	tvu networks
Product	tvu receiver / transceiver
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for tvu networks tvu receiver / transceiver

Be the first to know when new critical vulnerabilities affecting tvu networks tvu receiver / transceiver are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

TVU Networks / TVU Receiver / Transceiver

0 < 7.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code-white.com: https://code-white.com/public-vulnerability-list/#authentication-bypass-in-tvu-receiver-transceiver-web-management-interface vulncheck.com: https://www.vulncheck.com/advisories/tvu-networks-receiver-transceiver-missing-authentication-via-rest-api

Credits

Dr. Henning Kopp of CODE WHITE