CVE-2026-104076
TVU Networks Receiver/Transceiver Missing Authentication via REST API
TVU Networks TVU Receiver / Transceiver
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 7.9TVU Receiver / TransceiverCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.
Text from CVE List
Affected versions 1
- TVU Receiver / Transceiveraffected: all versions before 7.9CVE List