The vulnerability is an insufficiently short‑lived authentication token (X-User-Token) implemented in firmware versions 1.181.5 and earlier of Tattile Smart+, Vega, and Basic device families. A token once issued can be reused until a manual revocation, so an attacker who obtains a valid token—by intercepting traffic, reading logs, or reusing a token on a shared system—can authenticate to the device’s management interface indefinitely. The flaw amounts to a failure to properly enforce session token expiration (CWE‑613) and enables sustained unauthorized access to device functions and data.

Affected vendors and products are Tattile s.r.l.’s Smart+, Vega, Basic MK2, ANPR Mobile, Axle Counter, Smart+ Speed, Smart+ Traffic Light, Tolling+, Vega11, Vega33, and Vega53. Firmware versions 1.181.5 and earlier in all these devices are vulnerable.

The CVSS score of 8.7 indicates a high severity with potential impact on confidentiality, integrity, and availability. The EPSS score is reported as less than 1 %, suggesting that exploitation is currently rare but possible. This vulnerability is not listed in the CISA KEV catalog, so no publicly known active exploits have been reported. An attacker would typically need to capture or otherwise acquire a valid token—possible through network sniffing, log file access, or token reuse on a shared machine—and then use that token to continue authenticating to management services. Because the token persists until explicit revocation, the attack can be sustained over an extended period without further interaction, raising the risk to operational continuity.