Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Smart+
Vendor
Tattile s.r.l.
Product
Smart+
Platforms
Unknown
Default status
unaffected
Smart+ · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.181.5
None listed
Tolling+
Vendor
Tattile s.r.l.
Product
Tolling+
Platforms
Unknown
Default status
unaffected
Tolling+ · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.181.5
None listed
Smart+ Speed
Vendor
Tattile s.r.l.
Product
Smart+ Speed
Platforms
Unknown
Default status
unaffected
Smart+ Speed · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.181.5
None listed
Smart+ Traffic Light
Vendor
Tattile s.r.l.
Product
Smart+ Traffic Light
Platforms
Unknown
Default status
unaffected
Smart+ Traffic Light · Scoped product and version facts