CVE-2026-104075: Authentication Bypass Using an Alternate Path or Channel in TVU Networks TVU Receiver / Transceiver

CVE-2026-104075 describes an authentication bypass vulnerability in TVU Networks TVU Receiver and Transceiver devices running firmware versions earlier than 7.9. The issue exists in the web management login endpoint POST /tvu/Login, where an attacker can submit a crafted HTTP request with an empty or absent UserName parameter. This bypasses client-side JavaScript validation and allows the attacker to receive a valid administrative session cookie without needing a valid password, granting full administrative control over the device's web interface.

An unauthenticated remote attacker can exploit this vulnerability to gain full administrative access to the affected device's web management interface. This could allow the attacker to alter device configurations, disrupt operations, or perform other administrative actions without authorization. The CVSS 4.0 base score of 9.3 reflects the critical severity and the ease of exploitation without any privileges or user interaction.

Firmware version 7.9 or later addresses this vulnerability. Users should upgrade affected devices to version 7.9 or newer to remediate the authentication bypass. Since this is a device firmware issue and not a cloud service, remediation depends on applying the official firmware update from TVU Networks. Patch status is confirmed by the affectedVersions field indicating versions before 7.9 are vulnerable.