Cyber Posture

CVE-2026-26341

CriticalPublic PoC

Published: 24 February 2026

Published
24 February 2026
Modified
26 February 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0020 41.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default…

more

credentials and gain administrative access, enabling unauthorized access to device configuration and data.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires changing default authenticators prior to first use, preventing authentication with shipped default credentials on the management interface.

prevent

Mandates management of accounts including disabling unnecessary default accounts and reviewing access authorizations to block unauthorized administrative access.

prevent

Requires establishing and enforcing secure configuration settings, such as forcing credential changes during device installation or commissioning.

Security SummaryAI

CVE-2026-26341 affects the firmware of Tattile Smart+, Vega, and Basic device families in versions 1.181.5 and prior. These devices ship with default credentials that are not forced to be changed during installation or commissioning, exposing the management interface to authentication using those unchanged credentials.

An attacker who can reach the management interface over the network can exploit this vulnerability with no required privileges, low attack complexity, and no user interaction. Successful exploitation grants administrative access, enabling unauthorized modification of device configuration and access to sensitive data. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-1392.

Mitigation details are available in vendor and third-party advisories, including those from VulnCheck at https://www.vulncheck.com/advisories/tattile-smart-vega-basic-default-credentials, Zero Science Lab at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.php, and the Tattile website at https://www.tattile.com/.

Details

CWE(s)

Affected Products

tattile
smart\+ firmware
≤ 1.181.5
tattile
tolling\+ firmware
≤ 1.181.5
tattile
smart\+ speed firmware
≤ 1.181.5
tattile
smart\+ traffic light firmware
≤ 1.181.5
tattile
axle counter firmware
≤ 1.181.5
tattile
vega53 firmware
≤ 1.181.5
tattile
vega33 firmware
≤ 1.181.5
tattile
vega11 firmware
≤ 1.181.5
tattile
basic mk2 firmware
≤ 1.181.5
tattile
anpr mobile firmware
≤ 1.181.5

MITRE ATT&CK Enterprise TechniquesAI

T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Why these techniques?

The vulnerability exposes a network-accessible management interface with unchanged default credentials, enabling attackers to authenticate and gain administrative access, directly mapping to T1078.001: Default Accounts.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References