Key points
- CVE-2026-104076 is rated Critical with a CVSS score of 9.3.
- The flaw affects TVU Receiver and Transceiver devices running firmware prior to version 7.9.
- Attackers can exploit unprotected REST API endpoints on port 8288 to alter configurations.
A severe security flaw in TVU Networks hardware allows remote attackers to take control of device settings and steal sensitive information without needing a password. The vulnerability, tracked as CVE-2026-104076, impacts Receiver and Transceiver devices that are running firmware versions older than 7.9.
According to the National Vulnerability Database, this issue is rated Critical with a CVSS score of 9.3. The root cause is a missing authentication mechanism on specific REST API endpoints. These endpoints are accessible via port 8288 and do not require any form of login or credential verification. This means any individual with network access to the device can interact with its configuration interface directly.
How the Exploit Works
The vulnerability enables two primary types of malicious activity: data disclosure and configuration manipulation. An attacker can send simple GET requests to the exposed API to retrieve sensitive details about the device. This includes network configuration parameters, firmware version details, and information regarding connected cloud services.
More dangerously, the flaw allows for active manipulation of the device’s behaviour. By issuing POST requests to specific endpoints, such as /Setting3/API/API/v1/LocalNetwork/DNS, an attacker can change the DNS settings of the device. This change can redirect outbound connections intended for TVU cloud infrastructure to malicious servers controlled by the attacker. This technique facilitates man-in-the-middle attacks, allowing the interception or alteration of data in transit. The weakness is classified under CWE-306, which relates to incorrect default permissions or missing authentication controls.
Who Is Affected
The vulnerability specifically affects TVU Networks Receiver and Transceiver devices. The risk applies only to units running firmware versions before 7.9. Devices that have been updated to version 7.9 or later are not affected by this specific issue. Organisations using these devices for live video transmission or remote monitoring should verify their current firmware status immediately.
The exposure of port 8288 is the key factor here. If this port is open to the internet or accessible within a broad internal network, the attack surface is significant. Because no authentication is required, automated scanning tools could easily identify and exploit these devices at scale.
Our take on the response
The severity of this flaw lies in its simplicity. There is no need for sophisticated hacking tools or social engineering; the API is simply open. For security operations teams, this represents a clear case of misconfiguration or insufficient API hardening. The ability to hijack DNS settings is particularly concerning for broadcast and media organisations that rely on the integrity of their cloud connections.
While the source material indicates that firmware version 7.9 addresses this issue, organisations should not assume all devices are updated. Legacy devices or those in remote locations may still be running vulnerable versions. The lack of authentication on a configuration interface is a fundamental security failure that exposes the entire device to compromise.
What to do and how to stay safe: TVU Networks
- Audit your network to identify any TVU Receiver or Transceiver devices running firmware versions prior to 7.9.
- Verify that port 8288 is not accessible from untrusted networks or the public internet.
- Monitor network logs for unusual POST requests to DNS configuration endpoints on affected devices.
- Once the vendor provides an update, prioritise patching these devices to version 7.9 or later.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-104076?
It is a critical vulnerability in TVU Networks devices that allows unauthenticated remote attackers to read sensitive data and modify device configurations.
Which devices are affected by this flaw?
TVU Networks Receiver and Transceiver devices running firmware versions before 7.9 are affected.
Can attackers change DNS settings without a password?
Yes, the vulnerability allows attackers to send POST requests to alter DNS settings via unprotected API endpoints without authentication.