Description
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Tattile s.r.l. | Smart+ | <= 1.181.5 |
| Tattile s.r.l. | Tolling+ | <= 1.181.5 |
| Tattile s.r.l. | Smart+ Speed | <= 1.181.5 |
| Tattile s.r.l. | Smart+ Traffic Light | <= 1.181.5 |
| Tattile s.r.l. | Axle Counter | <= 1.181.5 |
| Tattile s.r.l. | Vega53 | <= 1.181.5 |
| Tattile s.r.l. | Vega33 | <= 1.181.5 |
| Tattile s.r.l. | Vega11 | <= 1.181.5 |
| Tattile s.r.l. | Basic MK2 | <= 1.181.5 |
| Tattile s.r.l. | ANPR Mobile | <= 1.181.5 |
References
- https://www.tattile.com/Product
- https://www.vulncheck.com/advisories/tattile-smart-vega-basic-default-credentialsThird Party Advisory, VDB Entry
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.phpExploit, Third Party Advisory
Timeline
- Published
- Feb 24, 2026
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed