The flaw is a missing authentication in the REST API of TVU Networks Receiver/Transceiver devices with firmware earlier than 7.9. Unauthenticated remote attackers can send GET requests to retrieve sensitive data such as network configuration, firmware information, and cloud service details, and can issue POST requests to paths like /Setting3/API/API/v1/LocalNetwork/DNS to change DNS settings. These actions enable configuration tampering and facilitate man‑in‑the‑middle attacks against outbound connections to the TVU cloud. The weakness corresponds to CWE‑306, reflecting an absence of proper authentication checks.

The affected systems are TVU Networks Receiver/Transceiver devices running any firmware version earlier than 7.9. No specific patch numbers are listed, but the vulnerability applies to all firmware releases prior to 7.9. These devices expose the vulnerable REST API on port 8288.

The CVSS score of 9.3 indicates a high‑severity vulnerability, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, but its mechanics are straightforward and the required network access is simple: an unauthenticated user can reach the device over the open port. Because the attack does not require any special client credentials, the likelihood of exploitation is high as soon as the device is reachable from the attacker’s network.