CVE-2026-104076

Name of the Vulnerable Software and Affected Versions TVU Networks Receiver/Transceiver devices versions prior to 7.9

Description Remote unauthenticated attackers can read sensitive device information and modify device configuration due to missing authentication on REST API endpoints on port 8288. By sending unauthenticated GET requests, attackers can disclose firmware details, network configuration, and cloud service information. Additionally, sending POST requests to the '/Setting3/API/API/v1/LocalNetwork/DNS' endpoint allows attackers to alter DNS settings, which can facilitate man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.

Recommendations Update TVU Networks Receiver/Transceiver devices to firmware version 7.9 or later. Restrict access to the REST API endpoints on port 8288 to minimize the risk of exploitation.