TVU Receiver/Transceiver EUVD-2026-95251

Exploitation requires network reachability to the device's web-management REST API on TCP port 8288, which exposes endpoints (e.g. /Setting3/API/API/v1/LocalNetwork/DNS) without any authentication - matching AV:N/AC:L/PR:N/UI:N. No special feature toggle or non-default mode is stated as required; the flaw affects the REST API as shipped on firmware before 7.9. The primary LIMITING factor is exposure: the attacker must be able to route to port 8288, so devices behind segmented management networks, firewalls, or ACLs that block 8288 are not remotely exploitable, substantially narrowing the practical attack surface versus the raw 9.3 score. The DNS-rewrite impact additionally depends on the device relying on the modified resolver for its outbound cloud connections.

This is a genuine high-priority issue, not a CVSS-inflated one. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) is internally consistent with a CWE-306 missing-authentication flaw on an internet-reachable REST API: no privileges, no user interaction, low complexity, and high confidentiality and integrity impact. The ability to both read sensitive device data (unauthenticated GET) and alter configuration such as DNS (unauthenticated POST) to enable man-in-the-middle on cloud traffic justifies the VC:H/VI:H rating. However, several exploitation signals are MISSING rather than negative: there is no EPSS score provided, no CISA KEV listing, and no explicit POC indicator in the input, so active exploitation cannot be asserted - current status is 'no public exploit identified at time of analysis.' The real-world risk is tempered by product footprint: TVU Networks receiver/transceiver units are specialized broadcast/live-video transport appliances, so the population of exposed devices is far smaller than for mainstream enterprise software, pointing to targeted rather than mass exploitation potential. Net assessment: technically severe and trivial to exploit where the device is network-reachable, but likely limited in scale by the niche deployment base and no confirmed exploitation to date.

An attacker who can reach TCP port 8288 on a TVU receiver/transceiver sends unauthenticated GET requests to the REST API to harvest network configuration, firmware version, and cloud-service details, then issues an unauthenticated POST to /Setting3/API/API/v1/LocalNetwork/DNS to rewrite the device's DNS settings. By pointing DNS at attacker-controlled resolvers, outbound connections to TVU cloud infrastructure are redirected, enabling man-in-the-middle interception of that traffic. No public exploit code is identified in the provided data, but the attack requires only standard HTTP requests against default endpoints.