Key points
- CVE-2026-104075 allows unauthenticated users to bypass login on TVU devices running firmware before version 7.9.
- The vulnerability carries a CVSS score of 9.3, rated as critical, due to the ease of exploitation and severity of impact.
- Attackers exploit the flaw by sending crafted HTTP requests with empty username fields to the web management interface.
The short version
- TVU Networks Receiver and Transceiver devices with firmware versions prior to 7.9 contain a critical authentication bypass vulnerability.
- Remote attackers can gain full administrative access to the web management interface without valid credentials.
- The exploit works by submitting a login request with an empty or missing username, bypassing client-side validation checks.
The details
TVU Networks Receiver and Transceiver devices are vulnerable to a critical authentication bypass flaw identified as CVE-2026-104075. According to the National Vulnerability Database (NVD), the issue affects devices running firmware versions earlier than 7.9. The vulnerability resides in the web management login endpoint, specifically the POST /tvu/Login interface.
The flaw allows remote, unauthenticated attackers to obtain an administrative session by manipulating the login request. Specifically, attackers can submit an HTTP request where the UserName parameter is either empty or absent entirely. Because the device fails to properly validate this input at the server level, it accepts the request and issues a valid session cookie, regardless of the password value provided. This bypasses the standard authentication process, granting the attacker full administrative control over the device's web management interface.
The NVD rates this vulnerability with a CVSS score of 9.3, classifying it as critical. The high severity rating reflects the fact that no authentication is required to exploit the bug and that successful exploitation results in complete system compromise. The weakness is categorized under CWE-288, which relates to improper verification of code integrity.
The context
This vulnerability highlights the risks associated with relying on client-side security measures, such as JavaScript validation, for critical authentication logic. In this case, the web interface likely uses JavaScript to prevent users from submitting a login form with a blank username. However, because this check occurs in the user's browser, an attacker can bypass it by sending a raw HTTP request directly to the server. This technique circumvents the front-end protections entirely, exposing the backend flaw.
For organizations using TVU devices for broadcast or video transmission, this exposure is significant. Administrative control allows an attacker to view configuration settings, alter network parameters, or potentially disrupt live feeds. Since the attack can be performed remotely and does not require prior access to the network, any device exposed to the internet or an untrusted network is at risk.
What to watch
Organizations should monitor their network traffic for unusual login attempts to TVU devices, particularly those originating from external IP addresses. Security teams should also keep an eye on vendor communications for official advisories regarding CVE-2026-104075. Any signs of unauthorized configuration changes or unexpected session activity on these devices should be investigated immediately.
What to do and how to stay safe: TVU Networks
- Inventory all TVU Networks Receiver and Transceiver devices to identify which units are running firmware versions prior to 7.9.
- Restrict network access to the web management interfaces of these devices, ensuring they are not directly accessible from untrusted networks or the internet.
- Monitor authentication logs for failed login attempts or suspicious patterns, such as requests with empty username fields, to detect potential exploitation.
- Once the vendor provides an update, apply firmware version 7.9 or later to all affected devices to patch the authentication bypass vulnerability.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-104075?
CVE-2026-104075 is a critical authentication bypass vulnerability in TVU Networks Receiver and Transceiver devices running firmware before version 7.9.
How do attackers exploit this vulnerability?
Attackers exploit the flaw by sending a crafted HTTP request to the login endpoint with an empty or absent username parameter, bypassing client-side validation.
What is the impact of a successful exploit?
A successful exploit allows remote, unauthenticated attackers to gain full administrative control of the device's web management interface.
