Tattile firmware versions up to 1.181.5 embed default administrative credentials that are not required to be changed during device configuration. An attacker who can reach the device’s management interface can authenticate with those defaults and gain full administrative privileges, enabling unauthorized modification of configuration settings and access to collected data. The weakness is identified as CWE‑1392, which describes the use of predictable or hard‑coded credentials that can be easily exploited.

Affected products are provided by Tattile s.r.l. and include ANPR Mobile, Axle Counter, Basic MK2, Smart+, Smart+ Speed, Smart+ Traffic Light, Tolling+, Vega11, Vega33, and Vega53. Firmware versions 1.181.5 and older are vulnerable; newer releases remove the default credentials.

The vulnerability carries a CVSS score of 9.3 indicating high severity, but the EPSS score of less than 1 percent reflects a very low measured probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation is achievable by anyone who can reach the management interface, which likely requires network connectivity to the device’s internal management port or an exposed service. No additional prerequisites such as physical access are required beyond network reachability.