CVE-2026-26342

🗓️ 24 Feb 2026 18:41:09Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 26 Views🌐 WEB

Tattile Smart Plus, Vega, Basic up to 1.181.5 have insufficient token expiration, enabling unauthorized access.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-26342	24 Feb 202618:41	–	attackerkb
Circl	CVE-2026-26342	24 Feb 202621:43	–	circl
CNNVD	Tattile Smart+ 代码问题漏洞	24 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-26342 Tattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token Expiration	24 Feb 202618:41	–	cvelist
NVD	CVE-2026-26342	24 Feb 202620:27	–	nvd
Packet Storm	📄 Tattile Cameras 1.181.5 Insufficient Token Expiration	24 Feb 202600:00	–	packetstorm
Positive Technologies	PT-2026-21790	24 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-26342	25 Feb 202622:17	–	redhatcve
Vulnrichment	CVE-2026-26342 Tattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token Expiration	24 Feb 202618:41	–	vulnrichment
Zero Science Lab	Tattile Cameras 1.181.5 Insufficient Token (X-User-Token) Expiration	24 Feb 202600:00	–	zeroscience

NVD

Vulners

CNA

Node

tattile smart+_firmwareRange≤1.181.5

AND

tattile smart+Match-

Node

tattile tolling+_firmwareRange≤1.181.5

AND

tattile tolling+Match-

Node

tattile smart+_speed_firmwareRange≤1.181.5

AND

tattile smart+_speedMatch-

Node

tattile smart+_traffic_light_firmwareRange≤1.181.5

AND

tattile smart+_traffic_lightMatch-

Node

tattile axle_counter_firmwareRange≤1.181.5

AND

tattile axle_counterMatch-

Node

tattile vega53_firmwareRange≤1.181.5

AND

tattile vega53Match-

Node

tattile vega33_firmwareRange≤1.181.5

AND

tattile vega33Match-

Node

tattile vega11_firmwareRange≤1.181.5

AND

tattile vega11Match-

Node

tattile basic_mk2_firmwareRange≤1.181.5

AND

tattile basic_mk2Match-

Node

tattile anpr_mobile_firmwareRange≤1.181.5

AND

tattile anpr_mobileMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Smart+",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Tolling+",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Smart+ Speed",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Smart+ Traffic Light",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Axle Counter",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Vega53",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Vega33",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Vega11",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Basic MK2",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "ANPR Mobile",
    "vendor": "Tattile s.r.l.",
    "versions": [
      {
        "lessThanOrEqual": "1.181.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
tattile	www.tattile.com/
vulncheck	www.vulncheck.com/advisories/tattile-smart-vega-basic-insufficient-session-token-expiration
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5976.php

Parameter	Position	Path	Description	CWE
X-User-Token	header	api/__internal__/__hal__/wifi/network/scan	Insufficient session expiration via reused tokens can enable unauthorized access to device management functions.	CWE-613

17 Jun 2026 10:26Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.19.8

CVSS 48.7

EPSS0.00716

SSVC

CWE-613