TVU Networks Receiver/Transceiver up to 7.8 Web Management Login Endpoint /tvu/Login UserName improper authentication

Summaryinfo

A vulnerability was found in TVU Networks Receiver and Transceiver up to 7.8. It has been declared as very critical. Affected is an unknown function of the file /tvu/Login of the component Web Management Login Endpoint. Such manipulation of the argument Username leads to improper authentication. This vulnerability is listed as CVE-2026-104075. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in TVU Networks Receiver and Transceiver up to 7.8. Affected by this issue is some unknown processing of the file /tvu/Login of the component Web Management Login Endpoint. The manipulation of the argument UserName with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.

The advisory is shared for download at code-white.com. This vulnerability is handled as CVE-2026-104075 since 10/01/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/08/2026).

Upgrading to version 7.9 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• TVU Networks

Name

• Receiver
• Transceiver

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion