high7.5
CVE-2026-26340
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication.
Impact
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tattile | Smart\+ Firmware | through 1.181.5 |
| Tattile | Tolling\+ Firmware | through 1.181.5 |
| Tattile | Smart\+ Speed Firmware | through 1.181.5 |
| Tattile | Smart\+ Traffic Light Firmware | through 1.181.5 |
| Tattile | Axle Counter Firmware | through 1.181.5 |
| Tattile | Vega53 Firmware | through 1.181.5 |
| Tattile | Vega33 Firmware | through 1.181.5 |
| Tattile | Vega11 Firmware | through 1.181.5 |
| Tattile | Basic Mk2 Firmware | through 1.181.5 |
| Tattile | Anpr Mobile Firmware | through 1.181.5 |