Описание
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.
Затрагиваемое ПО
Tattile Smart\+ firmwareTattile Smart\+Tattile Tolling\+ firmwareTattile Tolling\+Tattile Smart\+ speed firmwareTattile Smart\+ speedTattile Smart\+ traffic light firmwareTattile Smart\+ traffic lightTattile Axle counter firmwareTattile Axle counterTattile Vega53 firmwareTattile Vega53Tattile Vega33 firmwareTattile Vega33Tattile Vega11 firmwareTattile Vega11Tattile Basic mk2 firmwareTattile Basic mk2Tattile Anpr mobile firmwareTattile Anpr mobile
CVSS
| Балл | 7.5 — высокая |
| Вектор | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Источники
https://www.tattile.com/https://www.vulncheck.com/advisories/tattile-smart-vega-basic-unauthenticated-rtsp-stream-disclosurehttps://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5978.php