CVE-2026-26341

Published: Feb 24, 2026Modified: Jun 17, 2026

9.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.

Affected (10)

Products: Tattile: Smart+ Firmware, Tolling+ Firmware, Smart+ Speed Firmware, Smart+ Traffic Light Firmware, Axle Counter Firmware, Vega53 Firmware, Vega33 Firmware, Vega11 Firmware, Basic Mk2 Firmware, Anpr Mobile Firmware

Tattile

10 products

Smart+ Firmware

Tolling+ Firmware

Smart+ Speed Firmware

Smart+ Traffic Light Firmware

Axle Counter Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Smart+ Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Smart+	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Tolling+ Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Tolling+	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Smart+ Speed Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Smart+ Speed	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Smart+ Traffic Light Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Smart+ Traffic Light	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Axle Counter Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Axle Counter	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Vega53 Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Vega53	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Vega33 Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Vega33	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Vega11 Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Vega11	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Basic Mk2 Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Basic Mk2	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tattile Anpr Mobile Firmware	Up to 1.181.5

Running on/with	Platform Versions
Tattile Anpr Mobile	All versions

Related CWEs

CWE-1392

Use of Default Credentials

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

References (3)

https://www.tattile.com/

Source: disclosure@vulncheck.com

Product

https://www.vulncheck.com/advisories/tattile-smart-vega-basic-default-credentials

Source: disclosure@vulncheck.com

Third Party AdvisoryVDB Entry

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.php

Source: disclosure@vulncheck.com

ExploitThird Party Advisory

Timeline

No history available yet.