CVE-2026-26341

· CRITICALAnalyzed

← All CVEs

CVSS v3.1

9.8

CVSS v4.0

9.3

EPSS

2.66%

Published

Feb 24, 2026

Modified

Feb 26, 2026

Public PoC / Exploit (2)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1392

Affected Products (20)

tattile · smart\+_firmwarevulnerable

tattile · smart\+

tattile · tolling\+_firmwarevulnerable

tattile · tolling\+

tattile · smart\+_speed_firmwarevulnerable

tattile · smart\+_speed

tattile · smart\+_traffic_light_firmwarevulnerable

tattile · smart\+_traffic_light

tattile · axle_counter_firmwarevulnerable

tattile · axle_counter

tattile · vega53_firmwarevulnerable

tattile · vega53

tattile · vega33_firmwarevulnerable

tattile · vega33

tattile · vega11_firmwarevulnerable

tattile · vega11

tattile · basic_mk2_firmwarevulnerable

tattile · basic_mk2

tattile · anpr_mobile_firmwarevulnerable

tattile · anpr_mobile

References (3)

https://www.tattile.com/

Product

https://www.vulncheck.com/advisories/tattile-smart-vega-basic-default-credentials

Third Party AdvisoryVDB Entry

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.php

Third Party AdvisoryExploit

KEV Catalog EPSS Scores Vendors All CVEs