TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.
| CVE | CVE-2026-104075 |
|---|---|
| Severidad | CRITICAL |
| CVSS | 9.8 / 10 |
| CWE | CWE-288 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Producto afectado
TVU Networks Receiver/Transceiver devices running firmware before 7.9
Producto derivado de la descripción (el CPE estructurado de NVD aún no está publicado).