Executive Summary

CVE-2026-26340 affects Tattile Smart+, Vega, and Basic device families with firmware versions 1.181.5 and earlier. These devices expose RTSP (Real-Time Streaming Protocol) streams without requiring any authentication.

A remote attacker can connect to the RTSP service and access live video and audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and has a high severity rating with a CVSS v4 score of 8.7.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized remote attackers to access live video and audio streams from affected Tattile devices without any authentication.

As a result, sensitive surveillance data can be exposed, potentially compromising privacy and security.

The exposure of live surveillance streams can lead to unauthorized monitoring and misuse of sensitive information captured by these cameras.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Tattile devices exposing RTSP streams without authentication, allowing unauthorized access to live video and audio streams.

To detect this vulnerability on your network or system, you can scan for open RTSP services on devices running firmware version 1.181.5 or earlier from the affected Tattile product families.

A common approach is to use network scanning tools like nmap to identify devices with open RTSP ports (default port 554). For example, you can run the following command to scan a target IP or subnet:

• nmap -p 554 --open <target-ip-or-subnet>

Once an open RTSP port is found, you can attempt to connect to the RTSP stream using tools like VLC or ffmpeg without providing credentials to verify if authentication is required.

• ffmpeg -i rtsp://<target-ip>:554/stream
• vlc rtsp://<target-ip>:554/stream

If the stream is accessible without authentication, the device is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': "Immediate mitigation steps include restricting network access to the affected devices' RTSP service to trusted users only."}, {'type': 'paragraph', 'content': 'You should implement network segmentation and firewall rules to block unauthorized external access to port 554 (RTSP) on these devices.'}, {'type': 'paragraph', 'content': 'If possible, disable the RTSP service temporarily until a firmware update is available.'}, {'type': 'paragraph', 'content': 'Monitor vendor announcements and plan to apply the official patch expected around May 2026 (week 19) that addresses this vulnerability.'}, {'type': 'paragraph', 'content': 'Additionally, consider changing default credentials and reviewing device configurations to enhance security.'}] [1, 2]

Useful 0 Not Useful 0