Tattile Smart+ / Vega / Basic <= 1.181.5 Divulgação de Stream RTSP Não Autenticado

The primary impact of CVE-2026-26340 is the unauthorized exposure of live video and audio streams captured by Tattile surveillance devices. An attacker exploiting this vulnerability could gain real-time access to sensitive areas monitored by these devices, potentially compromising privacy and security. This could include observing private residences, businesses, or critical infrastructure. The lack of authentication means that any attacker with network access to the device can exploit this vulnerability, significantly broadening the potential attack surface. The blast radius extends to anyone who relies on the surveillance data captured by these devices, as the integrity and confidentiality of that data are directly at risk.

Organizations and individuals utilizing Tattile Smart+, Vega, and Basic surveillance devices are at risk. This includes businesses using these devices for security monitoring, homeowners relying on them for home surveillance, and potentially critical infrastructure facilities where these devices are deployed for security purposes. Legacy configurations with default network settings are particularly vulnerable.

• windows / supply-chain: Monitor network connections for RTSP traffic to Tattile devices. Use PowerShell to check for unusual processes accessing network resources.

Get-NetTCPConnection | Where-Object {$_.RemotePort -eq 554} | Select-Object LocalAddress, RemoteAddress, State

• linux / server: Use ss or netstat to identify RTSP connections. Examine system logs for authentication failures related to RTSP.

ss -t tcp -p 554

• generic web: Use curl to attempt connecting to the RTSP stream without authentication.

curl rtsp://<device_ip>:554/live

1. 2026-02-24Disclosure

   disclosure

1. Reservado2026-02-13
2. Publicada2026-02-24
3. Modificada2026-03-05
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2026-26340 is to upgrade the firmware on affected Tattile Smart+, Vega, and Basic devices to a version that includes the security fix. Tattile is expected to release a patched firmware version soon. Until a patch is available, consider segmenting the network to restrict access to the devices. Implement firewall rules to block external access to the RTSP port (typically 554) on the devices. Monitor network traffic for suspicious RTSP connections originating from unexpected sources. After upgrading the firmware, confirm the fix by attempting to connect to the RTSP stream without authentication; a successful connection indicates the vulnerability remains.