CVE-2026-104075 — TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login…
Published: 2026-10-08 · CVSS: 9.3 · CVSS 4.0
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7