PatchTheCVECVE-2026-26341: Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credenti
CVE-2026-26341 is a critical-severity flaw (CVSS 9.8) affecting smart\+ firmware, tolling\+ firmware, smart\+ speed firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.
Why this priority
- Critical severity
- Public exploit reference
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.9% (top 13%) |
| CISA exploited list | No |
| Weakness | CWE-1392 |
| Published | 2026-02-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Write-up: www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.php
- Nuclei scan template: Tattile Camera < 1.181.5 - Default Login
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-26341?
smart\+ firmware: upgrade to newer than 1.181.5; tolling\+ firmware: upgrade to newer than 1.181.5; smart\+ speed firmware: upgrade to newer than 1.181.5. Exact commands for each OS are on this page.
Is CVE-2026-26341 being exploited?
CVE-2026-26341 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-26341 affect?
CVE-2026-26341 affects smart\+ firmware, tolling\+ firmware, smart\+ speed firmware. Severity is critical (CVSS 9.8). Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can
How urgent is CVE-2026-26341?
Priority 69/100. Critical severity; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-26342 CRITICAL 9.8 UPGRADE UPGRADE Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authenticatio
- CVE-2026-26340 HIGH 7.5 UPGRADE UPGRADE Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams withou