CVE-2026-26342 is a critical flaw per the NVD record (CVSS 9.8) in Tattile Smart+, Vega and Basic firmware 1.181.5 and earlier. The X-User-Token that authenticates users does not expire in time, so a stolen token keeps working until revoked. No fixed version is listed.
What's affected
The VulnCheck advisory and the NVD record list firmware version 1.181.5 and prior across the Smart+, Tolling+, Smart+ Speed, Smart+ Traffic Light, Axle Counter, Vega and Basic families as affected.
No patched version is named. VulnCheck rates this one high on its own scale, and the NVD record's CVSS 3.1 score is 9.8.
How to check if you're exposed
Check the firmware version of each device. Then see how the management interface is reached and who can see the traffic. The advisory gives examples of how a token could be obtained: interception, exposure in logs, or reuse on a shared system. So check whether management traffic crosses networks you do not control, and whether tokens could end up in proxy or application logs.
If you cannot see the token lifetime in your own testing, ask Tattile how tokens are revoked and for how long they stay valid.
What to do now
- Ask Tattile how to revoke tokens and whether a firmware newer than 1.181.5 limits their lifetime.
- Use HTTPS and a VPN for all management access so tokens cannot be intercepted in transit.
- Scrub tokens from proxy, application and ticket logs, and limit who can read them.
- Do not use shared workstations to administer devices. Sign out and clear sessions after use.
- Rotate admin passwords after any suspected exposure, and check for unexpected configuration changes.
Why it matters
The weakness is CWE-613, insufficient session expiration. A session token is a bearer credential. Whoever holds it is treated as the user. If it never expires, a copy from a log file or a captured request is as good as the password, indefinitely.
The NVD vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, assumes no privileges are needed, which is why it reads critical, while VulnCheck's own score rates the issue high with low privileges required. Either way, the practical advice is the same: keep tokens out of reach and shorten their life.
The record is not on the CISA Known Exploited Vulnerabilities list. Pair this with CVE-2026-26341, default credentials on the same devices.
Quick check
Why do two scores differ for this CVE?
The NVD record scores 9.8 with no privileges required. VulnCheck scores it high and requires low privileges. The advice is the same.
Is a fix available?
No patched firmware is named in the sources. Ask Tattile.
Sources
- VulnCheck advisory: Tattile Smart+ / Vega / Basic up to 1.181.5 Insufficient Session Token Expiration
- Zero Science Lab disclosure ZSL-2026-5976 (cited by the record)
- NVD record for CVE-2026-26342
Last reviewed: 19 October 2026.
