HIGHCVE-2026-26340Published Modified CNA VulnCheck
CVE-2026-26340: Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.
Metrics
- CVSS v4.0
- 8.7
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 10
Affected packages
- Tattile s.r.l. / Smart+≤ 1.181.5
- Tattile s.r.l. / Tolling+≤ 1.181.5
- Tattile s.r.l. / Smart+ Speed≤ 1.181.5
- Tattile s.r.l. / Smart+ Traffic Light≤ 1.181.5
- Tattile s.r.l. / Axle Counter≤ 1.181.5
- Tattile s.r.l. / Vega53≤ 1.181.5
- Tattile s.r.l. / Vega33≤ 1.181.5
- Tattile s.r.l. / Vega11≤ 1.181.5
- Tattile s.r.l. / Basic MK2≤ 1.181.5
- Tattile s.r.l. / ANPR Mobile≤ 1.181.5
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NReferences