CVE-2026-26341
Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials
- State
- Published
- Severity
- 9.3 Critical
- Published
- Feb 24, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 13, 2026
Description
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-1392 Use of Default Credentials
Affected Products
| Product | Versions |
|---|---|
Smart+Tattile s.r.l. |
|
Tolling+Tattile s.r.l. |
|
Smart+ SpeedTattile s.r.l. |
|
Smart+ Traffic LightTattile s.r.l. |
|
Axle CounterTattile s.r.l. |
|
Vega53Tattile s.r.l. |
|
Vega33Tattile s.r.l. |
|
Vega11Tattile s.r.l. |
|
Basic MK2Tattile s.r.l. |
|
ANPR MobileTattile s.r.l. |
|
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.phptechnical-descriptionexploit
- https://www.tattile.com/product
- https://www.vulncheck.com/advisories/tattile-smart-vega-basic-default-credentialsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.