CVE-2026-104076: Missing Authentication for Critical Function in TVU Networks TVU Receiver / Transceiver

CVE-2026-104076 describes a missing authentication vulnerability in TVU Networks TVU Receiver and Transceiver devices running firmware versions earlier than 7.9. The REST API on port 8288 lacks authentication controls, permitting unauthenticated remote attackers to perform GET requests to disclose sensitive device information such as network configuration, firmware version, and cloud service details. Additionally, attackers can send POST requests to modify critical settings like DNS configuration, which could facilitate man-in-the-middle attacks on outbound traffic to TVU cloud infrastructure.

Exploitation of this vulnerability allows unauthenticated remote attackers to read sensitive device information and alter device configuration, including DNS settings. This can compromise device integrity and confidentiality, and enable man-in-the-middle attacks on communications with TVU cloud services, potentially leading to interception or manipulation of data.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to port 8288 on affected devices to trusted management networks only to reduce exposure.