CVE-2026-26340

🗓️ 24 Feb 2026 18:40:35Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 12 Views🌐 WEB

Unauthenticated stream access on Tattile Smart Plus, Vega, and Basic firmware up to 1.181.5 exposes live surveillance data.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-26340	24 Feb 202618:40	–	attackerkb
Circl	CVE-2026-26340	24 Feb 202622:16	–	circl
CNNVD	Tattile Smart+ 访问控制错误漏洞	24 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-26340 Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure	24 Feb 202618:40	–	cvelist
NVD	CVE-2026-26340	24 Feb 202620:27	–	nvd
OSV	CVE-2026-26340	24 Feb 202620:27	–	osv
Packet Storm	📄 Tattile Cameras 1.181.5 Unauthenticated RTSP Stream Disclosure	24 Feb 202600:00	–	packetstorm
Positive Technologies	PT-2026-21788	24 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-26340	25 Feb 202622:16	–	redhatcve
Vulnrichment	CVE-2026-26340 Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure	24 Feb 202618:40	–	vulnrichment

NVD

Vulners

CNA

Node

tattile smart+_firmwareRange≤1.181.5

AND

tattile smart+Match-

Node

tattile tolling+_firmwareRange≤1.181.5

AND

tattile tolling+Match-

Node

tattile smart+_speed_firmwareRange≤1.181.5

AND

tattile smart+_speedMatch-

Node

tattile smart+_traffic_light_firmwareRange≤1.181.5

AND

tattile smart+_traffic_lightMatch-

Node

tattile axle_counter_firmwareRange≤1.181.5

AND

tattile axle_counterMatch-

Node

tattile vega53_firmwareRange≤1.181.5

AND

tattile vega53Match-

Node

tattile vega33_firmwareRange≤1.181.5

AND

tattile vega33Match-

Node

tattile vega11_firmwareRange≤1.181.5

AND

tattile vega11Match-

Node

tattile basic_mk2_firmwareRange≤1.181.5

AND

tattile basic_mk2Match-

Node

tattile anpr_mobile_firmwareRange≤1.181.5

AND

tattile anpr_mobileMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Smart+",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Tolling+",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Smart+ Speed",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Smart+ Traffic Light",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Axle Counter",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Vega53",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Vega33",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Vega11",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Basic MK2",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "ANPR Mobile",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5978.php
tattile	www.tattile.com/
vulncheck	www.vulncheck.com/advisories/tattile-smart-vega-basic-unauthenticated-rtsp-stream-disclosure

Parameter	Position	Path	Description	CWE
default	path	rtsp://cameraIP:554/default	Unauthenticated access to live RTSP streams	CWE-306

17 Jun 2026 10:26Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.5

CVSS 48.7

EPSS0.00807

SSVC

CWE-306