CVE-2026-26340
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication.
Published Feb 24, 2026 · updated Jun 17, 2026 · tattile smart+ firmware
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 24, 2026 · NIST NVD
Detected
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.
Jun 17, 2026 · NIST NVD
Updated
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.
Affected
- cpe tattile/anpr mobile firmwareversion unspecified
- cpe tattile/axle counter firmwareversion unspecified
- cpe tattile/basic mk2 firmwareversion unspecified
- cpe tattile/smart+ firmwareversion unspecified
- cpe tattile/smart+ speed firmwareversion unspecified
- cpe tattile/smart+ traffic light firmwareversion unspecified
- cpe tattile/tolling+ firmwareversion unspecified
- cpe tattile/vega11 firmwareversion unspecified
- cpe tattile/vega33 firmwareversion unspecified
- cpe tattile/vega53 firmwareversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-26340
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-26340
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized dis
nvd.nist.gov