关键漏洞信息 漏洞名称 Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure 严重性 HIGH 日期 2023-02-24 CVE CVE-2026-26340 CWE CWE-306: Missing Authentication for Critical Function CVSS 8.7 CVSS V4 Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/V:I:N/VA:N/SC:N/SI:N/SA:N 参考文献 Zero Science Lab Disclosure (ZSL-2026-5978) Tattile Vendor Homepage 贡献者 Gjoko Krstic of Zero Science Lab 描述 Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.