CVE-2026-26341Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning.
Updated under an hour ago ()
Does this affect you?
It affects tattile smart+_firmware and 9 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-1392
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
tattile smart+_firmware tattile:smart+_firmware | through 1.181.5 | NVD |
tattile tolling+_firmware tattile:tolling+_firmware | through 1.181.5 | NVD |
tattile smart+_speed_firmware tattile:smart+_speed_firmware | through 1.181.5 | NVD |
tattile smart+_traffic_light_firmware tattile:smart+_traffic_light_firmware | through 1.181.5 | NVD |
tattile axle_counter_firmware tattile:axle_counter_firmware | through 1.181.5 | NVD |
tattile vega53_firmware tattile:vega53_firmware | through 1.181.5 | NVD |
tattile vega33_firmware tattile:vega33_firmware | through 1.181.5 | NVD |
tattile vega11_firmware tattile:vega11_firmware | through 1.181.5 | NVD |
tattile basic_mk2_firmware tattile:basic_mk2_firmware | through 1.181.5 | NVD |
tattile anpr_mobile_firmware tattile:anpr_mobile_firmware | through 1.181.5 | NVD |
References
- https://www.tattile.com/product
- https://www.vulncheck.com/advisories/tattile-smart-vega-basic-default-credentialsthird-party-advisory, vdb-entry
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.phpexploit, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.