Tvu Receiver Transceiver
Monthly
Missing authentication in TVU Networks Receiver/Transceiver firmware before 7.9 exposes the device web-management REST API on TCP port 8288, letting remote unauthenticated attackers read sensitive device information and modify configuration-including rewriting DNS via /Setting3/API/API/v1/LocalNetwork/DNS to enable man-in-the-middle attacks on outbound TVU cloud connections. The issue is scored CVSS 9.3 (v4.0) and independently assessed as AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:N under CVSS 3.1, with practical impact limited mainly by whether port 8288 is reachable from an untrusted network. No public exploit was identified at time of analysis.
Remote unauthenticated attackers can obtain a fully privileged administrative session on TVU Networks Receiver and Transceiver devices running firmware before 7.9 by sending a crafted HTTP request to the web management login endpoint POST /tvu/Login with an empty or absent UserName parameter; the password value is irrelevant and a valid session cookie is returned. The flaw is rated CVSS 4.0 9.3 (and assessed as CVSS 3.1 9.3 with high confidentiality, integrity, and availability impact), requires no authentication, no user interaction, and no non-default configuration, and because the request is issued directly it defeats the client-side JavaScript validation that would otherwise block it. No public exploit code or confirmed active exploitation was identified at time of analysis; the main practical limiting factor is network reachability of the device's management interface, so segmented or non-exposed management planes are not remotely exploitable.
Missing authentication in TVU Networks Receiver/Transceiver firmware before 7.9 exposes the device web-management REST API on TCP port 8288, letting remote unauthenticated attackers read sensitive device information and modify configuration-including rewriting DNS via /Setting3/API/API/v1/LocalNetwork/DNS to enable man-in-the-middle attacks on outbound TVU cloud connections. The issue is scored CVSS 9.3 (v4.0) and independently assessed as AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:N under CVSS 3.1, with practical impact limited mainly by whether port 8288 is reachable from an untrusted network. No public exploit was identified at time of analysis.
Remote unauthenticated attackers can obtain a fully privileged administrative session on TVU Networks Receiver and Transceiver devices running firmware before 7.9 by sending a crafted HTTP request to the web management login endpoint POST /tvu/Login with an empty or absent UserName parameter; the password value is irrelevant and a valid session cookie is returned. The flaw is rated CVSS 4.0 9.3 (and assessed as CVSS 3.1 9.3 with high confidentiality, integrity, and availability impact), requires no authentication, no user interaction, and no non-default configuration, and because the request is issued directly it defeats the client-side JavaScript validation that would otherwise block it. No public exploit code or confirmed active exploitation was identified at time of analysis; the main practical limiting factor is network reachability of the device's management interface, so segmented or non-exposed management planes are not remotely exploitable.