Remote attackers bypass login on TVU devices pre-7.9 via empty username exploit
A flaw in TVU video devices allows remote attackers to bypass login and gain full administrative access without valid credentials.
Key points
- The vulnerability is rated Critical with a CVSS score of 9.3.
- It affects TVU Receiver and Transceiver devices on firmware versions prior to 7.9.
- Attackers exploit the issue by sending a request with an empty username parameter.
TVU Networks devices used for live video production are vulnerable to a critical authentication bypass that allows unauthenticated attackers to take full control of the system. Security researchers have identified that the flaw exists in the web management interface of TVU Receiver and Transceiver units running firmware older than version 7.9. The issue enables remote attackers to obtain an administrative session without providing valid login credentials, posing a significant risk to organizations relying on these devices for secure video transmission.
In plain English
Authentication is the process of verifying a user's identity before granting access to a system. In this case, the TVU devices have a flaw in how they handle login requests. Normally, a user must enter a username and password to log in. However, the system fails to properly validate the username field.
An attacker can exploit this by sending a specific type of web request to the device's login page. If the attacker leaves the username field empty or omits it entirely, the device ignores the password and grants an administrative session cookie. This bypasses the security checks intended to keep unauthorized users out. Once inside, the attacker has the same level of access as a system administrator, allowing them to change settings, view sensitive data, or disrupt operations.
The background
The vulnerability is tracked as CVE-2026-104075 and is classified under CWE-288, which relates to authentication issues. It has been assigned a CVSS score of 9.3, indicating a critical severity level. The flaw resides in the POST /tvu/Login endpoint, which is the part of the web server that processes login attempts.
The issue arises because the client-side JavaScript validation, which is meant to check for input errors before sending data to the server, can be bypassed. Attackers can send crafted HTTP requests directly to the server, skipping the browser-based checks. This allows the malicious request with the empty username to reach the backend logic, which incorrectly processes it as a valid login attempt regardless of the password provided.
What changes now
Organizations using TVU Receiver or Transceiver devices must assess their current firmware versions immediately. Any device running a version prior to 7.9 is affected by this critical vulnerability. Since the source material does not confirm the availability of a patch or update, no fix has been confirmed yet. Until a vendor-provided update is available, affected devices remain exposed to remote exploitation.
Security teams should monitor network traffic for unusual activity originating from these devices, such as unexpected configuration changes or data exfiltration. Isolating affected devices from the internet or restricting access to the web management interface may help mitigate the risk temporarily.
What to do and how to stay safe: TVU Networks
- Audit your inventory to identify any TVU Receiver or Transceiver devices running firmware versions older than 7.9.
- Restrict network access to the web management interface of these devices, limiting exposure to trusted internal networks only.
- Monitor logs for unauthorized login attempts or session creations, particularly those involving empty or unusual username fields.
- Prepare to update firmware immediately once the vendor releases an official patch for CVE-2026-104075.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-104075?
It is a critical authentication bypass vulnerability in TVU Networks devices that allows attackers to gain administrative access without valid credentials.
Which devices are affected by this vulnerability?
TVU Receiver and Transceiver devices running firmware versions before 7.9 are affected.
How do attackers exploit this flaw?
Attackers send a crafted HTTP request to the login endpoint with an empty or absent username parameter, bypassing client-side validation.
