CVE-2026-26340: Unauth RTSP Stream in Tattile Smart+ Devices

The primary impact of CVE-2026-26340 is the unauthorized exposure of live video and audio streams captured by Tattile surveillance devices. An attacker exploiting this vulnerability could gain real-time access to sensitive areas monitored by these devices, potentially compromising privacy and security. This could include observing private residences, businesses, or critical infrastructure. The lack of authentication means that any attacker with network access to the device can exploit this vulnerability, significantly broadening the potential attack surface. The blast radius extends to anyone who relies on the surveillance data captured by these devices, as the integrity and confidentiality of that data are directly at risk.

1. Reserved2026-02-13
2. Published2026-02-24
3. Modified2026-03-05
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-26340 is to upgrade the firmware on affected Tattile Smart+, Vega, and Basic devices to a version that includes the security fix. Tattile is expected to release a patched firmware version soon. Until a patch is available, consider segmenting the network to restrict access to the devices. Implement firewall rules to block external access to the RTSP port (typically 554) on the devices. Monitor network traffic for suspicious RTSP connections originating from unexpected sources. After upgrading the firmware, confirm the fix by attempting to connect to the RTSP stream without authentication; a successful connection indicates the vulnerability remains.