What is the CVSS score of CVE-2026-26342?

CVE-2026-26342 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Vega33 Firmware are affected by CVE-2026-26342?

Tattile Smart+ devices in your organization are vulnerable to authentication bypass attacks due to tokens that do not expire properly, allowing attackers to maintain unauthorized access indefinitely.

Is there a public PoC exploit available for CVE-2026-26342?

Yes, a public proof-of-concept exploit is available for CVE-2026-26342. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-26342?

Within 24 hours: Inventory all Tattile Smart+, Vega, and Basic devices and isolate high-criticality units to air-gapped or restricted networks; document current firmware versions. Within 7 days: Implement network segmentation to limit device communication to essential systems only; enable enhanced logging for all device authentication attempts; rotate all administrative credentials. Within 30 days: Contact Tattile for patch availability timeline; evaluate replacement or upgrade options; conduct penetration testing on affected device access controls.

Vega33 Firmware CVE-2026-26342

CRITICAL

Insufficient Session Expiration (CWE-613)

2026-02-24 disclosure@vulncheck.com

Authentication Bypass Vega33 Firmware Basic Mk2 Firmware Axle Counter Firmware Vega53 Firmware Anpr Mobile Firmware Vega11 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 03:10 vuln.today

Public exploit code

CVE Published

Feb 24, 2026 - 20:27 nvd

CRITICAL 9.8

DescriptionCVE.org

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.

AnalysisAI

Persistent authentication token in Tattile ANPR cameras firmware 1.181.5 and prior. Authentication tokens never expire, enabling indefinite session reuse. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain valid X-User-Token via interception or log exposure

Exploit

Send authenticated requests with token to management interface

Execution

Access device functions and sensitive data

Impact

Execute unauthorized configuration or data manipulation

Access

Obtain valid X-User-Token via interception or log exposure

Exploit

Send authenticated requests with token to management interface

Execution

Access device functions and sensitive data

Impact

Execute unauthorized configuration or data manipulation

Vulnerability AssessmentAI

Exploitation	Tattile Smart+, Vega, or Basic device families running firmware version 1.181.5 or prior with valid X-User-Token obtained through interception, log exposure, or token reuse on shared systems. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.8, EPSS 0.31%. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Attacker obtains auth token (via default credentials or interception), retains permanent access to the ANPR camera system.
Remediation	Update firmware. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all Tattile Smart+, Vega, and Basic devices and isolate high-criticality units to air-gapped or restricted networks; document current firmware versions. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-26342 vulnerability details – vuln.today

Back

Vega33 Firmware CVE-2026-26342

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code