CVE-2026-104075: Tvu Networks Tvu Receiver / Transceiver

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.

Affected products

• Tvu Networks Tvu Receiver / Transceiver: before 7.9 (fixed in 7.9)

Published 2026-10-08. Last modified 2026-10-08.