CVE-2026-26340

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Missing Authentication for Critical Function pada tattile smart+ firmware, tattile tolling+ firmware +8 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.

Rincian

Terbit di NVD

24 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/tattile-smart-vega-basic-unauthenticated-rtsp-stream-disclosure advisory pihak ketiga · vdb entry
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5978.php exploit · advisory pihak ketiga
• https://www.tattile.com/ product