cbcvebase.
CVE-2026-26342
published 2026-02-24

CVE-2026-26342: Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient…

PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.72%
49.1th percentile
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.

Affected

20 ranges
VendorProductVersion rangeFixed in
tattileanpr_mobile_firmware<= 1.181.5—
tattileaxle_counter_firmware<= 1.181.5—
tattilebasic_mk2_firmware<= 1.181.5—
tattilesmart_+_firmware<= 1.181.5—
tattilesmart_+_speed_firmware<= 1.181.5—
tattilesmart_+_traffic_light_firmware<= 1.181.5—
tattiletolling_+_firmware<= 1.181.5—
tattilevega11_firmware<= 1.181.5—
tattilevega33_firmware<= 1.181.5—
tattilevega53_firmware<= 1.181.5—
tattile_s.r.lanpr_mobile<= 1.181.5—
tattile_s.r.laxle_counter<= 1.181.5—
tattile_s.r.lbasic_mk2<= 1.181.5—
tattile_s.r.lsmart<= 1.181.5—
tattile_s.r.lsmart+_speed<= 1.181.5—
tattile_s.r.lsmart+_traffic_light<= 1.181.5—
tattile_s.r.ltolling<= 1.181.5—
tattile_s.r.lvega11<= 1.181.5—
tattile_s.r.lvega33<= 1.181.5—
tattile_s.r.lvega53<= 1.181.5—

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.