CVEvulnerability

CVE-2026-26341

9.3 CRITICAL Published 2026-02-24 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-02-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1392

Description

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.

Affected configurations

• tattile smart\+ firmware (<= 1.181.5) • tattile tolling\+ firmware (<= 1.181.5) • tattile smart\+ speed firmware (<= 1.181.5) • tattile smart\+ traffic light firmware (<= 1.181.5) • tattile axle counter firmware (<= 1.181.5) • tattile vega53 firmware (<= 1.181.5) • tattile vega33 firmware (<= 1.181.5) • tattile vega11 firmware (<= 1.181.5) • tattile basic mk2 firmware (<= 1.181.5) • tattile anpr mobile firmware (<= 1.181.5)

Related

Weakness · CWE (1)

  • CWE-1392 Use of Default Credentials weakness

References