Authentication Bypass in TVU Networks Receiver and Transceiver Devices

TVU Networks Receiver and Transceiver devices running firmware versions before 7.9 are susceptible to an authentication bypass vulnerability (CVE-2026-104075). The vulnerability exists within the web management login interface at the POST /tvu/Login endpoint. Remote, unauthenticated attackers can successfully authenticate by submitting an HTTP request with an empty or absent UserName parameter. Because the application logic fails to validate the presence of the username before processing the request, the server issues a valid administrative session cookie regardless of whether a password is provided. This flaw allows attackers to bypass standard login procedures and gain full administrative control over the affected device's web management console. Given the nature of these devices in media transport workflows, unauthorized access could lead to the interception or manipulation of broadcast feeds and unauthorized configuration changes.

Impact

Successful exploitation results in full administrative access to the affected TVU Networks device. Attackers can modify system configurations, manage broadcast streams, or pivot to internal networks where these devices are deployed. This vulnerability targets broadcast infrastructure and media production environments, posing a significant risk to the integrity and confidentiality of broadcast operations.

Recommendation

Prioritized actions for security operations and IT teams:

• Patch all TVU Networks Receiver and Transceiver devices to firmware version 7.9 or later immediately.
• Restrict access to the web management interface of these devices to authorized management subnets via firewall rules.
• Monitor web server access logs for anomalous POST requests to /tvu/Login originating from unauthorized internal or external IP addresses.