CVE-2026-9139
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain a hard‑coded credential flaw in their web configuration interface. The login page stores plaintext admin credentials in client‑side JavaScript, allowing anyone who can reach the device to read them and gain full administrative control.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 devices.
Real-world impact
An attacker who can connect to the device over the network can view the embedded credentials in the page source and then log in as an administrator, giving them unrestricted access to configure or misuse the gateway.
Why this severity
The CVSS score of 9.3 reflects a network‑based attack with low complexity and no authentication required, combined with high impact on confidentiality, integrity, and availability. The vulnerability allows attackers to fully compromise the device, justifying the critical rating.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 20, 2026 · May 20, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.