CVE-2026-104076 in Receiver Transceiver
Summary
by MITRE • 10/08/2026
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
TVU Networks Receiver and Transceiver devices operating on firmware versions prior to 7.9 are affected by a critical missing authentication vulnerability that exposes sensitive operational data and allows for the unauthorized modification of device configurations. This flaw stems from the improper implementation of access controls within the device's web-based management interface, specifically affecting unprotected REST API endpoints accessible via port 8288. The absence of mandatory authentication mechanisms enables remote attackers who can reach these network ports to interact with the system without providing valid credentials or session tokens. This represents a fundamental failure in enforcing security boundaries between untrusted networks and critical infrastructure components, allowing any actor on the same subnet or those with routed access to exploit the interface directly.
The technical nature of this vulnerability aligns closely with CWE-287, which describes Improper Authentication, as well as CWE-359 regarding Exposure of Private Information Without Proper Authorization. Attackers can leverage standard HTTP GET requests against specific API endpoints to extract detailed internal state information from the device. This includes network configuration parameters such as IP addresses and subnet masks, firmware version details that aid in further targeted exploitation efforts, and cloud service connection strings or identifiers. The disclosure of this intelligence provides adversaries with a comprehensive map of the target environment, facilitating more sophisticated subsequent attacks by revealing how the device integrates into broader broadcast or transmission networks.
Beyond information disclosure, the vulnerability permits severe configuration manipulation through unauthenticated POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS. By altering DNS settings remotely, an attacker can redirect outbound traffic from the TVU device away from legitimate cloud infrastructure destinations toward malicious servers under their control. This capability effectively enables man-in-the-middle attacks on data streams transmitted by the receiver or transceiver. In professional broadcast and live production environments where these devices are deployed for critical video transmission, such manipulation could lead to signal hijacking, insertion of unauthorized content into live feeds, or complete disruption of service availability. The ability to modify DNS settings without authentication underscores a severe lack of input validation and privilege separation in the device firmware design.
From an operational impact perspective, this vulnerability poses significant risks to both data integrity and confidentiality within broadcast networks. For organizations relying on TVU Networks equipment for live streaming or remote production, unauthorized access could result in reputational damage due to compromised broadcasts or financial loss from service interruptions. Furthermore, because these devices often serve as gateways between local area networks and public internet-based cloud services, compromising them may provide a foothold for lateral movement into internal corporate networks if proper network segmentation is not enforced. The vulnerability maps directly to MITRE ATT&CK techniques including T1078 Valid Accounts in the context of default or weak credentials often found alongside such flaws, though here it specifically relates to missing authentication entirely, and T1564 Hidden Files and Directories for hiding malicious configurations, as well as T1090 Proxy which could be facilitated by DNS redirection.
Mitigation strategies must prioritize immediate patching of affected devices to firmware version 7.9 or later, where these access control issues have been addressed by the vendor. In environments where updating is not immediately feasible, network-level controls should be implemented to restrict access to port 8288 exclusively from trusted management subnets using firewall rules or VLAN segmentation. Additionally, organizations should audit their device configurations for any signs of unauthorized DNS changes and monitor outbound traffic anomalies that might indicate active exploitation attempts. Regular vulnerability assessments focusing on exposed API endpoints are recommended to ensure no other unauthenticated interfaces remain accessible in the broader network infrastructure.