CVE-2026-26340

HIGH

Tattile Smart+/Vega/Basic <1.181.5 - Auth Bypass

Title source: llm

Description

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.

References (3)

[Various Sources] https://www.tattile.com/

[Third Party Advisory] https://www.vulncheck.com/advisories/tattile-smart-vega-basic-unauthenticated-rtsp-stream-disclosure

[Third Party Advisory] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5978.php

Scores

CVSS v3 7.5

EPSS 0.0054

EPSS Percentile 67.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-306

Status published

Affected Products (10)

tattile/smart\+_firmware < 1.181.5

tattile/tolling\+_firmware < 1.181.5

tattile/smart\+_speed_firmware < 1.181.5

tattile/smart\+_traffic_light_firmware < 1.181.5

tattile/axle_counter_firmware < 1.181.5

tattile/vega53_firmware < 1.181.5

tattile/vega33_firmware < 1.181.5

tattile/vega11_firmware < 1.181.5

tattile/basic_mk2_firmware < 1.181.5

tattile/anpr_mobile_firmware < 1.181.5

Timeline

Published Feb 24, 2026

Tracked Since Feb 25, 2026