CVE-2026-104075 TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login
Remote attackers can bypass authentication on TVU Receiver/Transceiver devices by submitting an empty username, gaining full administrative control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104075?
CVE-2026-104075 is a critical authentication bypass vulnerability in TVU Receiver / Transceiver, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.
Weakness: CWE-288
Which versions are affected by CVE-2026-104075?
How do I fix CVE-2026-104075?
No fix has been published for CVE-2026-104075 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-104075 being exploited?
There is no known exploitation of CVE-2026-104075 in the wild and no public exploit code.
Sources
Also known as GHSA-6m79-2fc6-x428.