Description (CNA)
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Tattile s.r.l. / Smart+ | affected 0 through 1.181.5 |
| Tattile s.r.l. / Tolling+ | affected 0 through 1.181.5 |
| Tattile s.r.l. / Smart+ Speed | affected 0 through 1.181.5 |
| Tattile s.r.l. / Smart+ Traffic Light | affected 0 through 1.181.5 |
| Tattile s.r.l. / Axle Counter | affected 0 through 1.181.5 |
| Tattile s.r.l. / Vega53 | affected 0 through 1.181.5 |
| Tattile s.r.l. / Vega33 | affected 0 through 1.181.5 |
| Tattile s.r.l. / Vega11 | affected 0 through 1.181.5 |
| Tattile s.r.l. / Basic MK2 | affected 0 through 1.181.5 |
| Tattile s.r.l. / ANPR Mobile | affected 0 through 1.181.5 |
CWE
CWE-613
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5976.php
- https://www.tattile.com/
- https://www.vulncheck.com/advisories/tattile-smart-vega-basic-insufficient-session-token-expiration
ADP enrichment
No English description supplied.
No references supplied.