Firmware 7.9 Patch Stops Empty Username Login Bypass on TVU Receivers and Transceivers

TVU Networks Receiver and Transceiver devices contain a critical authentication bypass vulnerability that allows remote, unauthenticated attackers to gain full administrative control. The flaw, identified as CVE-2026-104075, carries a CVSS score of 9.3, rated as Critical. It exists in the web management login endpoint and affects devices running firmware versions prior to 7.9.

The risk

The vulnerability resides in the POST /tvu/Login endpoint of the device's web management interface. According to the National Vulnerability Database (NVD), attackers can exploit this weakness by submitting an HTTP request with an empty or absent UserName parameter. This action bypasses client-side JavaScript validation that normally prevents such inputs.

When an attacker sends this crafted request, the server processes it and returns a valid session cookie, regardless of the password value provided. This grants the attacker an administrative session, providing full control over the device's web management interface. The weakness is classified under CWE-288, which covers improper authentication mechanisms. Because the exploit requires no valid credentials and can be performed remotely, it poses a significant risk to organizations relying on these devices for video transmission and reception.

Who is exposed

The affected products are TVU Networks Receiver and Transceiver devices. Specifically, any unit running firmware versions earlier than 7.9 is vulnerable. Organizations that have not updated their hardware to the patched version remain exposed to this remote exploitation vector. The NVD record explicitly lists "TVU Networks TVU Receiver / Transceiver before 7.9" as the affected configuration.

Cost and compliance

The source material does not provide specific details regarding financial losses, regulatory fines, or compliance implications associated with this vulnerability. However, the critical severity rating and the nature of the flaw—allowing full administrative access without authentication—suggest significant potential for operational disruption and data compromise.

What should you do?

Business leaders should immediately inventory all TVU Networks Receiver and Transceiver devices to identify those running firmware versions prior to 7.9. Organizations should prioritize updating these devices to version 7.9 or later to mitigate the risk of unauthorized administrative access. Until updates are applied, network segmentation should be reviewed to limit external access to the device management interfaces.

What to do and how to stay safe: TVU Networks

• Audit your network inventory to locate all TVU Networks Receiver and Transceiver devices and verify their current firmware versions.
• Isolate vulnerable devices from public-facing networks or restrict access to the web management interface using firewall rules if immediate patching is not possible.
• Monitor network logs for unusual HTTP POST requests to the /tvu/Login endpoint, particularly those with missing or empty username fields.
• Once the vendor provides an update, apply firmware version 7.9 or later to all affected devices to resolve the authentication bypass.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-104075?

CVE-2026-104075 is a critical authentication bypass vulnerability in TVU Networks Receiver and Transceiver devices running firmware before version 7.9.

How do attackers exploit this vulnerability?

Attackers exploit the flaw by sending a crafted HTTP request to the login endpoint with an empty or absent username parameter, bypassing client-side validation to obtain an admin session.

Which devices are affected?

TVU Networks Receiver and Transceiver devices running firmware versions prior to 7.9 are affected by this vulnerability.