Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.
References
| Link | Resource |
|---|---|
| https://www.tattile.com/ | Product |
| https://www.vulncheck.com/advisories/tattile-smart-vega-basic-insufficient-session-token-expiration | VDB Entry Vendor Advisory |
| https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5976.php | Vendor Advisory Exploit |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
Configuration 9 (hide)
| AND |
|
Configuration 10 (hide)
| AND |
|
History
27 Feb 2026, 03:10
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Tattile basic Mk2
Tattile tolling\+ Tattile vega33 Tattile smart\+ Speed Firmware Tattile axle Counter Firmware Tattile smart\+ Traffic Light Firmware Tattile vega33 Firmware Tattile smart\+ Tattile Tattile anpr Mobile Firmware Tattile tolling\+ Firmware Tattile smart\+ Traffic Light Tattile basic Mk2 Firmware Tattile vega53 Tattile axle Counter Tattile smart\+ Speed Tattile vega53 Firmware Tattile anpr Mobile Tattile vega11 Firmware Tattile smart\+ Firmware Tattile vega11 |
|
| References | () https://www.tattile.com/ - Product | |
| References | () https://www.vulncheck.com/advisories/tattile-smart-vega-basic-insufficient-session-token-expiration - VDB Entry, Vendor Advisory | |
| References | () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5976.php - Vendor Advisory, Exploit | |
| CPE | cpe:2.3:o:tattile:axle_counter_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:tattile:tolling\+:-:*:*:*:*:*:*:* cpe:2.3:o:tattile:vega33_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:tattile:vega53_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:tattile:vega53:-:*:*:*:*:*:*:* cpe:2.3:h:tattile:smart\+_traffic_light:-:*:*:*:*:*:*:* cpe:2.3:h:tattile:smart\+_speed:-:*:*:*:*:*:*:* cpe:2.3:h:tattile:anpr_mobile:-:*:*:*:*:*:*:* cpe:2.3:o:tattile:basic_mk2_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:tattile:smart\+_traffic_light_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:tattile:basic_mk2:-:*:*:*:*:*:*:* cpe:2.3:o:tattile:vega11_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:tattile:tolling\+_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:tattile:anpr_mobile_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:tattile:vega33:-:*:*:*:*:*:*:* cpe:2.3:o:tattile:smart\+_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:tattile:vega11:-:*:*:*:*:*:*:* cpe:2.3:h:tattile:smart\+:-:*:*:*:*:*:*:* cpe:2.3:o:tattile:smart\+_speed_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:tattile:axle_counter:-:*:*:*:*:*:*:* |
24 Feb 2026, 20:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-24 20:27
Updated : 2026-02-27 03:10
NVD link : CVE-2026-26342
Mitre link : CVE-2026-26342
CVE.ORG link : CVE-2026-26342
JSON object : View
Products Affected
tattile
- smart\+_traffic_light
- vega53_firmware
- vega33_firmware
- vega11
- anpr_mobile_firmware
- basic_mk2_firmware
- smart\+_traffic_light_firmware
- vega53
- smart\+
- axle_counter
- basic_mk2
- vega11_firmware
- axle_counter_firmware
- smart\+_speed_firmware
- vega33
- tolling\+
- smart\+_speed
- anpr_mobile
- tolling\+_firmware
- smart\+_firmware
CWE
CWE-613
Insufficient Session Expiration