Key points
- TVU Networks devices running firmware before version 7.9 are vulnerable to remote administrative takeover.
- The flaw allows attackers to bypass authentication by submitting an empty or absent username parameter.
- A CVSS score of 9.3 marks this authentication bypass as a critical security risk for affected installations.
TVU Networks Receiver and Transceiver devices running firmware versions prior to 7.9 contain a critical authentication bypass vulnerability that allows remote attackers to gain full administrative control. The flaw, tracked as CVE-2026-104075, enables unauthenticated users to obtain valid session cookies by manipulating the login request. This weakness bypasses standard security checks, granting immediate access to the web management interface without needing valid credentials.
How it unfolded
- The vulnerability resides in the POST /tvu/Login endpoint used for web management authentication on affected devices.
- Attackers exploit the flaw by sending crafted HTTP requests that omit or leave the UserName parameter empty.
- The device accepts these malformed requests and issues a valid session cookie regardless of the password value provided.
Who is affected
TVU Networks Receiver and Transceiver hardware running any firmware version earlier than 7.9 is directly affected by this security issue. The vulnerability exists in the server-side processing logic, which fails to validate the presence of a username before issuing administrative sessions. According to the National Vulnerability Database record, the issue is classified under CWE-288, indicating improper authentication mechanisms. Any device exposing this web management interface to an untrusted network is at risk of unauthorized administrative access.
What happens next
The severity of CVE-2026-104075 is rated as critical with a CVSS score of 9.3, reflecting the ease of exploitation and the high impact on system integrity. Remote attackers can bypass client-side JavaScript validation by sending direct HTTP requests, making the attack vector accessible from the internet if the device is exposed. There is no indication that a fix has been confirmed yet in the source material, so administrators must assume pre-7.9 devices remain vulnerable until further notice.
What to do and how to stay safe: TVU Networks
- Audit all TVU Networks Receiver and Transceiver devices to identify those running firmware versions prior to 7.9.
- Restrict network access to the web management interface by placing devices behind strict firewall rules or VLAN segmentation.
- Monitor network logs for unusual POST requests to the /tvu/Login endpoint that may indicate exploitation attempts.
- Isolate affected devices from public networks immediately to prevent remote attackers from gaining administrative control.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific TVU devices are vulnerable to CVE-2026-104075?
TVU Networks Receiver and Transceiver devices running firmware versions before 7.9 are affected by this authentication bypass vulnerability.
How do attackers exploit the empty username flaw?
Attackers send crafted HTTP requests to the login endpoint with an empty or missing UserName parameter to bypass authentication checks.
Is there a patch available for this vulnerability?
No fix has been confirmed yet in the provided source material; administrators should wait for vendor updates or apply network restrictions.
