Description (CNA)
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Tattile s.r.l. / Smart+ | affected 0 through 1.181.5 |
| Tattile s.r.l. / Tolling+ | affected 0 through 1.181.5 |
| Tattile s.r.l. / Smart+ Speed | affected 0 through 1.181.5 |
| Tattile s.r.l. / Smart+ Traffic Light | affected 0 through 1.181.5 |
| Tattile s.r.l. / Axle Counter | affected 0 through 1.181.5 |
| Tattile s.r.l. / Vega53 | affected 0 through 1.181.5 |
| Tattile s.r.l. / Vega33 | affected 0 through 1.181.5 |
| Tattile s.r.l. / Vega11 | affected 0 through 1.181.5 |
| Tattile s.r.l. / Basic MK2 | affected 0 through 1.181.5 |
| Tattile s.r.l. / ANPR Mobile | affected 0 through 1.181.5 |
CWE
CWE-306
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5978.php
- https://www.tattile.com/
- https://www.vulncheck.com/advisories/tattile-smart-vega-basic-unauthenticated-rtsp-stream-disclosure
ADP enrichment
No English description supplied.
No references supplied.