CVE-2026-104076: TVU Networks Receiver/Transceiver Missing Authentication via REST API
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TVU Networks Receiver/Transceiverto a version that resolves this vulnerability.Fixed in 7.9
Event History
Frequently Asked Questions
Which devices should be prioritized for remediation?
TVU Networks Receiver/Transceiver devices running firmware earlier than 7.9 should be prioritized, particularly where the REST API on port 8288 is reachable by untrusted networks.
What does an attacker need to exploit this issue?
An attacker needs network access to the affected device's REST API on port 8288. No authentication, privileges, or user interaction are required.
How can I determine whether a device is exposed?
Check whether the device is running firmware before 7.9 and whether port 8288 accepts unauthenticated REST requests. Successful unauthenticated GET requests that disclose network configuration, firmware details, or cloud service information indicate exposure.
What is the practical impact of configuration modification?
An attacker can submit unauthenticated POST requests to alter configuration, including DNS settings through the LocalNetwork/DNS endpoint. DNS modification can enable man-in-the-middle attacks against outbound connections to TVU cloud infrastructure.