CVE-2026-26342: Tattile Anpr Mobile Firmware

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.

Affected products

• Tattile Anpr Mobile Firmware: up to and including 1.181.5
• Tattile Axle Counter Firmware: up to and including 1.181.5
• Tattile Basic MK2 Firmware: up to and including 1.181.5
• Tattile Smart+ Firmware: up to and including 1.181.5
• Tattile Smart+ Speed Firmware: up to and including 1.181.5
• Tattile Smart+ Traffic Light Firmware: up to and including 1.181.5
• Tattile Tolling+ Firmware: up to and including 1.181.5
• Tattile VEGA11 Firmware: up to and including 1.181.5
• Tattile VEGA33 Firmware: up to and including 1.181.5
• Tattile VEGA53 Firmware: up to and including 1.181.5

Published 2026-02-24. Last modified 2026-06-17.