Vulnerability · Published Feb 24, 2026 · Assigned by VulnCheck
CVE-2026-26341Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials
Critical 9.3
In plain English
A critical-severity security flaw in ANPR Mobile from Tattile s.r.l.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tattile s.r.l. | Smart+ | 0 – through 1.181.5 |
| Tattile s.r.l. | Tolling+ | 0 – through 1.181.5 |
| Tattile s.r.l. | Smart+ Speed | 0 – through 1.181.5 |
| Tattile s.r.l. | Smart+ Traffic Light | 0 – through 1.181.5 |
| Tattile s.r.l. | Axle Counter | 0 – through 1.181.5 |
| Tattile s.r.l. | Vega53 | 0 – through 1.181.5 |
| Tattile s.r.l. | Vega33 | 0 – through 1.181.5 |
| Tattile s.r.l. | Vega11 | 0 – through 1.181.5 |
| Tattile s.r.l. | Basic MK2 | 0 – through 1.181.5 |
| Tattile s.r.l. | ANPR Mobile | 0 – through 1.181.5 |
Weakness: CWE-1392 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.php technical-description, exploit
- https://www.tattile.com/ product
- https://www.vulncheck.com/advisories/tattile-smart-vega-basic-default-credentials third-party-advisory