CVE-2026-26340CWE-306

Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure

High · published February 24, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
66.6
In the wild
Unconfirmed
What it is

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.01149 · 66.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-02-24T18:40Z
EPSS history
Timeline
  • 24 FEB 18:40Z
    Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure
    cvelistv5