CVE-2026-104076

{
  "etk_id": "ETK-2026-1010",
  "cve_id": "CVE-2026-104076",
  "display_id": "CVE-2026-104076",
  "ghsa_id": "GHSA-8r82-mqvw-r8jr",
  "euvd_id": "EUVD-2026-95251",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in TVU Receiver/Transceiver REST API",
  "summary": "TVU Receiver/Transceiver devices running firmware earlier than 7.9 are affected. An unauthenticated remote attacker who can reach the REST service on port 8288 may obtain sensitive device details and alter configuration, including network settings.",
  "mitigation": "Upgrade TVU Receiver/Transceiver firmware to version 7.9. Until all devices are updated, restrict port 8288 to trusted management networks and block untrusted remote access.",
  "vendor": "TVU Networks",
  "product": "TVU Receiver / Transceiver",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 7.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7.9"
      ],
      "package_name": "TVU Receiver / Transceiver",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0035,
  "epss_percentile": 0.2753,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 11.419640633333334,
  "t0_at": "2026-10-08T19:26:34.263000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-08T21:32:57.440807+00:00",
      "days": 0.08776826165509259,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T19:26:34.263000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-08T19:26:34.263000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T19:26:34.263000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104076"
    }
  }
}