CVE-2026-26340: Tattile Anpr Mobile Firmware

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.

Affected products

• Tattile Anpr Mobile Firmware: up to and including 1.181.5
• Tattile Axle Counter Firmware: up to and including 1.181.5
• Tattile Basic MK2 Firmware: up to and including 1.181.5
• Tattile Smart+ Firmware: up to and including 1.181.5
• Tattile Smart+ Speed Firmware: up to and including 1.181.5
• Tattile Smart+ Traffic Light Firmware: up to and including 1.181.5
• Tattile Tolling+ Firmware: up to and including 1.181.5
• Tattile VEGA11 Firmware: up to and including 1.181.5
• Tattile VEGA33 Firmware: up to and including 1.181.5
• Tattile VEGA53 Firmware: up to and including 1.181.5

Published 2026-02-24. Last modified 2026-06-17.