CVE-2026-26340

HIGH

Tattile Smart+/Vega/Basic <1.181.5 - Auth Bypass

Title source: llm
STIX 2.1

Description

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.

References (3)

Scores

CVSS v3 7.5
EPSS 0.0079
EPSS Percentile 74.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (10)
tattile/anpr_mobile_firmware < 1.181.5
tattile/axle_counter_firmware < 1.181.5
tattile/basic_mk2_firmware < 1.181.5
tattile/smart\+_firmware < 1.181.5
tattile/smart\+_speed_firmware < 1.181.5
tattile/smart\+_traffic_light_firmware < 1.181.5
tattile/tolling\+_firmware < 1.181.5
tattile/vega11_firmware < 1.181.5
tattile/vega33_firmware < 1.181.5
tattile/vega53_firmware < 1.181.5
Published Feb 24, 2026
Tracked Since Feb 25, 2026