CVE-2026-26342
EUVD-2026-855324.02.2026, 20:27
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| tattile | smart\+_firmware | 𝑥 ≤ 1.181.5 |
| tattile | tolling\+_firmware | 𝑥 ≤ 1.181.5 |
| tattile | smart\+_speed_firmware | 𝑥 ≤ 1.181.5 |
| tattile | smart\+_traffic_light_firmware | 𝑥 ≤ 1.181.5 |
| tattile | axle_counter_firmware | 𝑥 ≤ 1.181.5 |
| tattile | vega53_firmware | 𝑥 ≤ 1.181.5 |
| tattile | vega33_firmware | 𝑥 ≤ 1.181.5 |
| tattile | vega11_firmware | 𝑥 ≤ 1.181.5 |
| tattile | basic_mk2_firmware | 𝑥 ≤ 1.181.5 |
| tattile | anpr_mobile_firmware | 𝑥 ≤ 1.181.5 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration