CVE-2026-104075
Last modified
CVE-2026-104075 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface..
Description
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TVU Networks | TVU Receiver / Transceiver | < 7.9 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-104075?
How severe is CVE-2026-104075?
How do I fix CVE-2026-104075?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-104058Podgrab contains a missing authentication vulnerability in w…5.3
- CVE-2026-104059Lektor 3.3.14 and 3.4.0b15 contains a cross-site request for…8.1
- CVE-2026-104069HortusFox before 6.2 contains a remote code execution vulner…7.2
- CVE-2026-104070The Crayons plugin for SPIP before 3.5.0 contains a missing …9.8
- CVE-2026-104073NetBox versions 2.9.5 before 4.7.0 contain a server-side tem…7.6
- CVE-2026-104074Coturn 4.10.0 contains an uninitialized memory disclosure vu…5.3
- CVE-2026-104076TVU Networks Receiver/Transceiver devices running firmware b…9.1
- CVE-2026-104077Obsidian Desktop before 1.14.0 contains a remote code execut…7.8
- CVE-2026-104078Obsidian Desktop before 1.14.0 contains a filter bypass vuln…7.8
- CVE-2026-104079Envira Gallery Lite before 1.16.2 contains a missing authori…4.3
- CVE-2026-104081KodExplorer before 4.55 contains a path traversal vulnerabil…8.1
- CVE-2026-104082SmarterMail before build 9777 contains a remote code executi…7.2
Are you affected by CVE-2026-104075?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST