CVE-2026-26340: Tattile Smart+ Information Disclosure Flaw

CVE-2026-26340 Overview

CVE-2026-26340 is a Missing Authentication vulnerability affecting Tattile Smart+, Vega, and Basic device families running firmware versions 1.181.5 and prior. The vulnerability exposes RTSP (Real Time Streaming Protocol) streams without requiring authentication, allowing remote attackers to connect to the RTSP service and access live video and audio streams without valid credentials. This results in unauthorized disclosure of surveillance data from affected traffic monitoring and automatic number plate recognition (ANPR) camera systems.

Critical Impact

Unauthenticated access to live video/audio streams from surveillance cameras deployed in traffic monitoring, tolling, and law enforcement environments could expose sensitive surveillance data, vehicle tracking information, and potentially personally identifiable information.

Affected Products

• Tattile Smart+ Firmware (versions ≤ 1.181.5)
• Tattile Smart+ Speed Firmware (versions ≤ 1.181.5)
• Tattile Smart+ Traffic Light Firmware (versions ≤ 1.181.5)
• Tattile Tolling+ Firmware (versions ≤ 1.181.5)
• Tattile Vega53 Firmware (versions ≤ 1.181.5)
• Tattile Vega33 Firmware (versions ≤ 1.181.5)
• Tattile Vega11 Firmware (versions ≤ 1.181.5)
• Tattile Basic MK2 Firmware (versions ≤ 1.181.5)
• Tattile Axle Counter Firmware (versions ≤ 1.181.5)
• Tattile ANPR Mobile Firmware (versions ≤ 1.181.5)

Discovery Timeline

• 2026-02-24 - CVE-2026-26340 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-26340

Vulnerability Analysis

This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). The affected Tattile camera devices expose their RTSP streaming endpoints without implementing any authentication mechanism, allowing any network-accessible attacker to view live surveillance feeds. RTSP is a standard protocol used for establishing and controlling media sessions between endpoints, typically operating on port 554/TCP.

The lack of authentication on the RTSP service means that attackers can directly connect to affected devices and stream live video and audio content without providing any credentials. This is particularly concerning given that these devices are commonly deployed in sensitive environments such as traffic monitoring systems, toll collection infrastructure, law enforcement ANPR deployments, and general surveillance applications.

Root Cause

The root cause of this vulnerability is the absence of authentication enforcement on the RTSP streaming service within the affected firmware. The firmware fails to require any form of credential validation before granting access to the media streams. This represents a fundamental security design flaw where a critical function (access to live surveillance feeds) lacks proper access controls.

Attack Vector

The attack vector is network-based, requiring no user interaction or authentication. An attacker with network access to the vulnerable device can exploit this vulnerability by simply connecting to the RTSP service. The exploitation path involves:

1. Identifying a vulnerable Tattile camera device on the network through service discovery or port scanning
2. Connecting to the RTSP service (typically on port 554)
3. Requesting available media streams without providing authentication credentials
4. Receiving and viewing live video/audio feeds from the surveillance camera

Due to the network-based attack vector, devices exposed to the internet are at significantly higher risk. However, even devices on internal networks can be exploited by attackers who have gained initial network access through other means.

The attack does not require any special privileges, authentication credentials, or user interaction, making it trivial to exploit once network connectivity to the target device is established. Attackers can use standard RTSP clients such as VLC, FFmpeg, or specialized tools to connect to and stream from the vulnerable devices.

Detection Methods for CVE-2026-26340

Indicators of Compromise

• Unusual or unauthorized RTSP connections to Tattile camera devices, particularly from external IP addresses or unexpected internal hosts
• Network traffic analysis showing RTSP protocol activity (typically port 554/TCP) to camera devices from unapproved sources
• Log entries indicating RTSP session establishment without corresponding authentication events
• Increased bandwidth consumption on camera devices indicating potential unauthorized streaming

Detection Strategies

• Implement network monitoring to detect RTSP traffic (port 554/TCP) to Tattile camera devices and alert on connections from unauthorized sources
• Deploy network intrusion detection systems (NIDS) with signatures to detect unauthenticated RTSP DESCRIBE and SETUP requests to vulnerable devices
• Conduct regular network scans to identify exposed RTSP services on Tattile devices and verify authentication requirements
• Monitor firewall and network device logs for connection attempts to camera RTSP ports from unexpected network segments

Monitoring Recommendations

• Enable and centralize logging from network devices that segment camera traffic to track access patterns
• Implement alerts for any RTSP connections to Tattile devices originating from outside the designated management network
• Regularly audit network access control lists (ACLs) protecting surveillance camera infrastructure
• Consider deploying network traffic analysis tools capable of identifying RTSP protocol anomalies

How to Mitigate CVE-2026-26340

Immediate Actions Required

• Isolate all affected Tattile camera devices on a dedicated network segment with strict access controls
• Implement firewall rules to restrict RTSP service access (port 554/TCP) to only authorized management systems and viewing stations
• Audit current network exposure of affected devices and disable any internet-facing access immediately
• Contact Tattile support to inquire about firmware updates that address this vulnerability

Patch Information

At the time of publication, organizations should consult Tattile directly for firmware updates addressing this vulnerability. Review the VulnCheck Advisory and Zero Science vulnerability report (ZSL-2026-5978) for additional technical details and remediation guidance.

Workarounds

• Deploy network-level access controls (firewalls, VLANs) to restrict RTSP service access to authorized systems only
• Implement a VPN requirement for any remote access to camera infrastructure
• Consider placing a reverse proxy or VPN gateway in front of camera devices to enforce authentication before traffic reaches the RTSP service
• Disable RTSP streaming if not required for operational purposes until a patch is available

# Example firewall rule to restrict RTSP access (iptables)
# Allow RTSP only from authorized management network (e.g., 10.10.10.0/24)
iptables -A INPUT -p tcp --dport 554 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 554 -j DROP