TVU Networks Firmware Flaw Lets Hackers Hijack DNS and Steal Configs Without Login

TVU Networks Receiver and Transceiver devices contain a critical security flaw that allows remote attackers to manipulate device configurations without authentication. The vulnerability, tracked as CVE-2026-104076, affects hardware running firmware versions earlier than 7.9. According to the National Vulnerability Database, the issue carries a CVSS score of 9.3, rated as critical.

The flaw stems from missing authentication on REST API endpoints exposed on port 8288. Because these endpoints are unprotected, any remote actor with network access can send requests to the device. This lack of access control enables attackers to both read sensitive information and write changes to the device’s settings.

In plain English

Most network devices require a username and password before allowing changes to their settings. These TVU devices, however, leave their control panel open to the internet without any such check. An attacker does not need to guess a password or exploit a complex code error. They simply need to know the IP address of the device.

Once connected, the attacker can send simple commands to the device. They can ask the device to reveal its internal network setup, firmware version, and details about cloud services it connects to. More dangerously, they can force the device to change where it looks for internet addresses. By altering the DNS settings, an attacker can redirect the device’s traffic, potentially intercepting data sent to TVU’s cloud infrastructure.

The background

The vulnerability is classified under CWE-306, which refers to missing authentication for critical functions. The specific attack vector involves unauthenticated GET requests for data disclosure and POST requests for configuration changes. One specific endpoint mentioned in the advisory is /Setting3/API/API/v1/LocalNetwork/DNS. Modifying this endpoint allows an attacker to change the Domain Name System settings.

This change is significant because it can enable man-in-the-middle attacks. If the device sends outbound connections to TVU cloud infrastructure, altering the DNS can trick the device into connecting to a server controlled by the attacker instead of the legitimate TVU server. This compromises the integrity and confidentiality of the data in transit.

What changes now

Organizations using TVU hardware must verify their firmware versions immediately. Any device running a version before 7.9 is considered vulnerable. Security teams should scan their networks for devices listening on port 8288 to identify potential exposure. Until a patch is confirmed and applied, these devices should be isolated from untrusted networks to prevent unauthorized access.

What to do and how to stay safe: TVU Networks

• Inventory all TVU Receiver and Transceiver devices and check their current firmware versions against the vulnerable range.
• Block inbound traffic to port 8288 at the network perimeter or firewall to prevent external access to the API.
• Monitor network logs for unusual DNS change requests or unexpected outbound connections from these devices.
• Segment vulnerable devices from the main corporate network to limit the blast radius if they are compromised.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which devices are affected by CVE-2026-104076?

TVU Networks Receiver and Transceiver devices running firmware versions prior to 7.9 are affected.

Can an attacker take full control of the device?

The vulnerability allows attackers to read sensitive configuration data and modify specific settings like DNS, but does not necessarily grant full system control.

Is there a patch available for this vulnerability?

The source material indicates that firmware version 7.9 addresses the issue, but does not confirm if this version is currently available for download.