CVE-2026-104075

Summary

This vulnerability allows remote attackers to bypass authentication and gain full administrative control over TVU Networks Receiver/Transceiver devices by sending a crafted HTTP request to the web management login endpoint.

Exploitability

Exploitation is relatively straightforward as it requires sending a specific HTTP request to the /tvu/Login endpoint with an empty or absent UserName parameter. The attacker must have network access to the device.

Blast radius

If exploited, the attacker can gain full administrative control over the device's web management interface, potentially leading to data exfiltration, device compromise, or further network attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 7.9 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.