critical9.8
CVE-2026-26342
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expirati…
Impact
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tattile | Smart\+ Firmware | through 1.181.5 |
| Tattile | Tolling\+ Firmware | through 1.181.5 |
| Tattile | Smart\+ Speed Firmware | through 1.181.5 |
| Tattile | Smart\+ Traffic Light Firmware | through 1.181.5 |
| Tattile | Axle Counter Firmware | through 1.181.5 |
| Tattile | Vega53 Firmware | through 1.181.5 |
| Tattile | Vega33 Firmware | through 1.181.5 |
| Tattile | Vega11 Firmware | through 1.181.5 |
| Tattile | Basic Mk2 Firmware | through 1.181.5 |
| Tattile | Anpr Mobile Firmware | through 1.181.5 |