by Kastro
Paper/Archive/CVE-2026-26341

CVE-2026-26341

Tattile s.r.l. Smart+ — Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 86.9.869 × 2017.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.

Affected

ProductAffectedFixed inSource
Smart+≤ 1.181.5–CNA
Tolling+≤ 1.181.5–CNA
Smart+ Speed≤ 1.181.5–CNA
Smart+ Traffic Light≤ 1.181.5–CNA
Axle Counter≤ 1.181.5–CNA
Vega53≤ 1.181.5–CNA
Vega33≤ 1.181.5–CNA
Vega11≤ 1.181.5–CNA
Basic MK2≤ 1.181.5–CNA
ANPR Mobile≤ 1.181.5–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitzeroscience.mk/en/vulnerabilities/ZSL-2026-5977.phpreftattile.comwriteupvulncheck.com/advisories/tattile-smart-vega-basic-default-credentials