CRITICAL 9.3 NVD
CVE-2026-104075
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoin
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.
References
- https://code-white.com/public-vulnerability-list/#authentication-bypass-in-tvu-receiver-tr
- https://www.vulncheck.com/advisories/tvu-networks-receiver-transceiver-authentication-bypa
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-08 via NVD.
Risk Timeline
CVE Disclosed2026-10-08 · 3 days ago
Remediation Resources
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.