TVU Receiver/Transceiver CVE-2026-104075

Exploitation requires network access to the device's web management interface and a crafted HTTP request to the specific endpoint POST /tvu/Login in which the UserName parameter is empty or absent; the password value is irrelevant. The only meaningful limiting factor is reachability of the management interface - devices whose management plane is segmented or not exposed to the attacker's network are not remotely exploitable. The flaw affects firmware versions before 7.9, so devices already on 7.9+ are not vulnerable. No authentication, no user interaction, and no non-default configuration is needed; because the bypass is performed by sending the request directly, client-side JavaScript validation provides no protection.

This is a genuine high-priority issue rather than a CVSS-inflated paper risk. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially exploitable, remote, pre-authentication flaw: an attacker needs only network reachability to the web management interface and a single crafted HTTP POST to /tvu/Login with an empty or absent UserName parameter to be issued a valid administrative session cookie regardless of password. The VC:H/VI:H/VA:H impact (full administrative control) is consistent with the description. All three exploitability signals that exist agree - low complexity, no privileges, no user interaction - and the logic (bypass of client-side JavaScript validation by sending the request directly) is simple enough to reproduce from the description alone, so weaponization is low-effort. That said, several corroborating signals are MISSING: there is no EPSS score, no CISA KEV listing, and no explicit POC flag in the input. Absence of these is not evidence of low risk - it most likely reflects the recency/niche nature of the finding rather than low exploitability. Net: treat as a critical, imminently exploitable authentication bypass on any internet- or network-exposed TVU management interface, while noting that real-world exploitation volume is unconfirmed by EPSS/KEV data.

An attacker who can reach a TVU Receiver/Transceiver web management interface (directly exposed or via a pivoted internal host) sends a single crafted POST to /tvu/Login omitting the UserName field, bypassing the browser-side validation that would normally block it. The server returns a valid administrative session cookie irrespective of the password, granting full control of the device's management interface. No public exploit is identified at time of analysis, but the technique is simple enough to reproduce directly from the advisory description.