PT-2026-21788 · Tattile · Tattile Smart++2

Gjoko Krstic · Published 2026-02-24 · Updated 2026-02-26 · CVE-2026-26340

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tattile Smart+ versions prior to 1.181.6 Tattile Vega versions prior to 1.181.6 Tattile Basic versions prior to 1.181.6

Description The firmware on Tattile Smart+, Vega, and Basic device families, versions 1.181.5 and earlier, allows unauthorized access to Real Time Streaming Protocol (RTSP) streams. An attacker can connect to the RTSP service without providing valid credentials and access live video and audio feeds, leading to the disclosure of surveillance data.

Recommendations Update Tattile Smart+ to a version later than 1.181.5. Update Tattile Vega to a version later than 1.181.5. Update Tattile Basic to a version later than 1.181.5.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-26340

Affected Products

Tattile Basic

Tattile Smart+

Tattile Vega

References · 9

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5978.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26340 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26340 · Vendor Advisory
• https://t.me/cveNotify/153344 · Telegram Post
• https://twitter.com/CVEnew/status/2026676439303720972 · Twitter Post
• https://vulncheck.com/advisories/tattile-smart-vega-basic-unauthenticated-rtsp-stream-disclosure · Note
• https://t.me/CVEtracker/45647 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026489186312651197 · Twitter Post
• https://tattile.com · Note