Missing Authentication in TVU Networks Receiver/Transceiver Devices
CVE-2026-104076

9.3CRITICAL

Key Information:

Vendor

Tvu Networks

Status
Tvu Receiver / Transceiver
Vendor
CVE Published:
8 October 2026

What is CVE-2026-104076?

TVU Networks Receiver and Transceiver devices running outdated firmware are vulnerable to a significant security risk due to a missing authentication flaw. This vulnerability enables remote attackers to send unauthenticated GET requests, allowing them to retrieve sensitive information such as network configurations, firmware details, and cloud service information through unsecured REST API endpoints on port 8288. Additionally, attackers may execute POST requests to manipulate device settings, including changing DNS configurations, which can facilitate man-in-the-middle attacks targeting connections to the TVU cloud infrastructure. It is crucial for users of these devices to upgrade to the latest firmware to mitigate the risks associated with this vulnerability.

Affected Version(s)

TVU Receiver / Transceiver 0 < 7.9

References

https://code-white.com/public-vulnerability-list/#authent...
third-party-advisory
https://www.vulncheck.com/advisories/tvu-networks-receive...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dr. Henning Kopp of CODE WHITE
.