CVE-2026-104075

Name of the Vulnerable Software and Affected Versions TVU Networks Receiver/Transceiver devices versions prior to 7.9

Description An authentication bypass exists in the web management login endpoint 'POST /tvu/Login'. Remote unauthenticated attackers can obtain an administrative session by submitting an empty or absent UserName parameter. By sending a crafted HTTP request that bypasses client-side JavaScript validation, an attacker can receive a valid session cookie regardless of the password provided, granting full administrative control of the web management interface.

Recommendations Update TVU Networks Receiver/Transceiver devices to firmware version 7.9 or later.