What’s Vulnerable › Vulnerabilities

CVE-2026-26340: Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-24 · updated 2026-06-17
• Weakness: CWE-306

Description

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.

Affected products

• Tattile Anpr Mobile Firmware: through 1.181.5
• Tattile Axle Counter Firmware: through 1.181.5
• Tattile Basic Mk2 Firmware: through 1.181.5
• Tattile Smart+ Firmware: through 1.181.5
• Tattile Smart+ Speed Firmware: through 1.181.5
• Tattile Smart+ Traffic Light Firmware: through 1.181.5
• Tattile Tolling+ Firmware: through 1.181.5
• Tattile Vega11 Firmware: through 1.181.5
• Tattile Vega33 Firmware: through 1.181.5
• Tattile Vega53 Firmware: through 1.181.5

References

• https://www.tattile.com/
• https://www.vulncheck.com/advisories/tattile-smart-vega-basic-unauthenticated-rtsp-stream-disclosure
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5978.php

Get alerted when CVE-2026-26340 or the next vulnerability affects your stack