Key points
- CVE-2026-104075 allows unauthenticated remote attackers to bypass login on TVU Receivers and Transceivers.
- The vulnerability exists in firmware versions prior to 7.9 and is rated Critical with a CVSS score of 9.3.
- Attackers exploit the POST /tvu/Login endpoint by omitting the username parameter to obtain administrative session cookies.
TVU Networks devices running firmware versions before 7.9 are vulnerable to a critical authentication bypass that grants remote attackers full administrative control. The flaw, tracked as CVE-2026-104075, allows unauthenticated users to circumvent login protections by submitting crafted HTTP requests to the web management interface.
The vulnerability resides in the web management login endpoint, specifically the POST /tvu/Login path. According to the National Vulnerability Database (NVD), attackers can bypass client-side JavaScript validation by sending a request that contains an empty or absent UserName parameter. This manipulation allows the server to issue a valid session cookie regardless of the password value provided. Consequently, an attacker gains complete administrative access to the device’s web management interface without knowing valid credentials. The NVD rates this weakness as Critical with a CVSS score of 9.3, citing CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
Context and Background
This authentication bypass highlights the risks of relying on client-side validation for security controls. While the user interface may enforce username entry through JavaScript, the underlying server logic failed to verify the presence of the parameter before issuing session tokens. This discrepancy allows direct HTTP requests to bypass interface restrictions. The flaw affects TVU Networks Receiver and Transceiver devices, which are commonly used in live video production and broadcast workflows. These devices often require remote management capabilities, increasing the attack surface if exposed to untrusted networks.
Who Is Affected
The vulnerability impacts TVU Networks TVU Receiver and Transceiver devices operating on any firmware version prior to 7.9. Organizations using these devices for video transmission and reception should immediately verify their current firmware levels. Devices running version 7.9 or later are not affected by this specific flaw, as the update addresses the authentication logic error. There is no indication in the source material that this vulnerability affects other TVU product lines or firmware versions beyond the specified range.
Our take on the response
Security teams must treat this vulnerability as an urgent priority due to the ease of exploitation and the severity of the impact. The ability to gain administrative access without authentication allows attackers to potentially alter device configurations, intercept video streams, or pivot into internal networks. The lack of required credentials makes automated scanning and exploitation trivial for threat actors. Immediate action is required to verify firmware versions and apply the available update to version 7.9 or later. Until patches are applied, network segmentation and strict access controls should be enforced to limit exposure to untrusted networks.
Background: Threat actors
Threat actors in cybersecurity are individuals or groups who intentionally compromise systems to steal data, disrupt operations or extort money. They range from lone hackers to state-sponsored teams. Defending against them requires analysing behaviour, not just blocking known malicious files or IP addresses.
Read the full guide: Threat Actors in Cybersecurity: Tactics, Profiles and Detection Strategies
What to do and how to stay safe: TVU Networks
- Inventory all TVU Receiver and Transceiver devices to identify those running firmware versions prior to 7.9.
- Apply firmware update 7.9 or later to all affected devices as soon as possible to resolve the authentication bypass.
- Restrict access to the web management interface using network firewalls to ensure only authorised management stations can reach the POST /tvu/Login endpoint.
- Monitor network logs for unusual HTTP POST requests to TVU devices, particularly those originating from untrusted or external IP addresses.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-104075?
The National Vulnerability Database rates CVE-2026-104075 as Critical with a CVSS score of 9.3.
Which TVU devices are affected by this vulnerability?
TVU Networks Receiver and Transceiver devices running firmware versions before 7.9 are affected.
How do attackers exploit this authentication bypass?
Attackers send crafted HTTP requests to the POST /tvu/Login endpoint with an empty or missing UserName parameter to obtain an administrative session cookie.