CVE-2026-26341: Default Credentials in Tattile Smart+ and Vega

CVE-2026-26341 is a critical flaw (CVSS 9.8) in Tattile Smart+, Vega and Basic device firmware 1.181.5 and earlier. The devices ship with default credentials that are never forced to change, so anyone who can reach the management interface can log in as an administrator. No fixed version is listed.

What's affected

The VulnCheck advisory and the NVD record say firmware version 1.181.5 and prior is affected. The VulnCheck page lists the product families: Smart+, Tolling+, Smart+ Speed, Smart+ Traffic Light, Axle Counter, Vega53, Vega33, Vega11, Basic MK2 and ANPR Mobile.

No patched firmware is named. Check with Tattile for guidance and for newer releases.

How to check if you're exposed

Find out whether you operate any of these devices. They are traffic and plate recognition cameras and similar roadside equipment, so owners are often highway, city, parking and tolling operators.

For each device, record the firmware version and test whether the management interface still accepts the default credentials from the vendor documentation. Do this only on devices you own, from a trusted management network.

Then check where the management interface can be reached from. A device whose web interface is visible from the internet is the highest priority.

What to do now

1. Change the default credentials on every device now, using a unique strong password per device or a central credential store.
2. Take the management interface off the internet. Reach it through a VPN or a management network segment.
3. Ask Tattile for a firmware newer than 1.181.5 and for guidance on forced password change at commissioning.
4. Add a step to your commissioning checklist: no device goes live until the default credentials are gone.
5. Review device logs for logins you do not recognise, and check device settings for unexpected changes.

Why it matters

The weakness is CWE-1392, use of default credentials. It is the oldest and most reliable way into field equipment. The device works as shipped, nobody is forced to change the password, and a document somewhere lists the default.

The advisory notes that an attacker who authenticates gains administrative access to device configuration and data. For cameras that read license plates, that means access to potentially sensitive records and to the settings that control them. The vector shows a network attack path with no privileges and no user action.

The record is not on the CISA Known Exploited Vulnerabilities list. It was disclosed with a second flaw, CVE-2026-26342, about long lived session tokens on the same devices.

Quick check

Sources

• VulnCheck advisory: Tattile Smart+ / Vega / Basic up to 1.181.5 Default Credentials
• Zero Science Lab disclosure ZSL-2026-5977 (cited by the record)
• NVD record for CVE-2026-26341

Last reviewed: 19 October 2026.