AG1000-01A SMS Alert Gateway — CraftedSignal Threat Feed

Taiko AG1000-01A SMS Alert Gateway Stored XSS (CVE-2026-9144)

hello@craftedsignal.io — Wed, 20 May 2026 20:19:00 +0000

The Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting (XSS) vulnerability, identified as CVE-2026-9144, within its embedded web configuration interface. This flaw enables authenticated attackers to inject and execute persistent JavaScript code within the administrative dashboard. The attack involves bypassing front-end length restrictions by fragmenting malicious payloads across multiple administrative form fields, using techniques like JavaScript comments and template literals to concatenate executable script fragments. These fragments are then rendered in administrative dashboard views, such as index.zhtml, leading to persistent script execution whenever an administrator accesses the affected pages. This vulnerability poses a significant risk to the confidentiality and integrity of the SMS Alert Gateway.

Attack Chain

An attacker authenticates to the Taiko AG1000-01A SMS Alert Gateway web configuration interface.
The attacker identifies multiple administrative form fields that allow input.
The attacker crafts a malicious JavaScript payload, designed to execute arbitrary commands or exfiltrate sensitive data.
The attacker fragments the payload into smaller chunks, using JavaScript comments (/* ... */) and template literals to bypass front-end length restrictions on the form fields.
The attacker submits the fragmented payload across multiple administrative form fields.
When an administrator accesses a dashboard view such as index.zhtml, the fragmented JavaScript payload is reassembled and executed within the administrator’s browser.
The executed JavaScript can perform actions such as stealing administrator cookies, modifying configuration settings, or launching further attacks against the gateway.
The attacker achieves persistent code execution on the SMS Alert Gateway administrative interface, potentially compromising the entire system.

Impact

Successful exploitation of this stored XSS vulnerability (CVE-2026-9144) could allow an attacker to compromise the Taiko AG1000-01A SMS Alert Gateway. The attacker could gain unauthorized access to sensitive configuration data, modify alert settings, or even use the gateway as a platform for launching further attacks. Given the nature of SMS alert gateways, a compromised device could be used to send malicious SMS messages, leading to potential phishing or malware distribution campaigns.

Recommendation

Deploy the Sigma rule Detect Taiko AG1000-01A Fragmented XSS Attempt to detect attempts to inject malicious JavaScript by fragmenting payloads across multiple administrative form fields in web server logs.
Apply input validation and output encoding to all administrative form fields on the Taiko AG1000-01A SMS Alert Gateway to prevent XSS attacks.
Monitor web server logs for suspicious activity related to the web configuration interface, focusing on requests with fragmented JavaScript payloads.
Apply any available patches or updates from Taiko to address CVE-2026-9144.

Taiko AG1000-01A SMS Alert Gateway Authentication Bypass (CVE-2026-9141)

hello@craftedsignal.io — Wed, 20 May 2026 20:18:42 +0000

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 is vulnerable to an authentication bypass (CVE-2026-9141). The embedded web configuration interface lacks proper session management and server-side authentication checks. This vulnerability allows unauthenticated attackers with network access to bypass authentication and directly access internal application pages. Successful exploitation grants attackers full administrative read and write access to the device. This allows them to modify alarm routing, device configuration, and disrupt monitoring and control functions.

Attack Chain

The attacker gains network access to the Taiko AG1000-01A device.
The attacker sends an HTTP GET request to the device’s web interface.
The attacker bypasses authentication by directly requesting internal resources such as /index.zhtml, /point.zhtml, or /log.shtml.
The web server, lacking authentication checks, serves the requested internal resource to the unauthenticated attacker.
The attacker analyzes the exposed configuration data in index.zhtml to understand device settings.
The attacker modifies alarm routing rules via point.zhtml, redirecting alerts to attacker-controlled systems.
The attacker alters device configuration settings, potentially disabling security features or adding malicious scripts via point.zhtml.
The attacker disrupts monitoring and control functions, leading to potential operational outages or safety incidents.

Impact

Successful exploitation of CVE-2026-9141 allows unauthenticated attackers to gain full administrative access to the Taiko AG1000-01A SMS Alert Gateway. This can lead to unauthorized modification of alarm routing, device configuration, and disruption of monitoring and control functions. The CVSS v3.1 base score for this vulnerability is 9.8, indicating a critical risk. Affected sectors include any organizations using this device for critical alerting, such as industrial control systems or emergency notification systems.

Recommendation

Deploy the Sigma rule detecting direct access to sensitive ZHTML pages to identify potential exploitation attempts (see rules section).
Restrict network access to the Taiko AG1000-01A web interface to authorized personnel only using firewall rules (see network-based rule in rules section).
Monitor web server logs for requests to sensitive files (index.zhtml, point.zhtml, log.shtml) without prior authentication.

Taiko AG1000-01A SMS Alert Gateway Hardcoded Credentials Vulnerability (CVE-2026-9139)

hello@craftedsignal.io — Wed, 20 May 2026 20:18:24 +0000

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 are vulnerable to a critical security flaw (CVE-2026-9139) due to hard-coded credentials in the device’s web configuration interface. The vulnerability stems from the authentication mechanism being implemented entirely in client-side JavaScript within the login.zhtml page. The static plaintext credentials are exposed directly in the page source, making them easily accessible to anyone with network access to the device. This vulnerability allows an unauthenticated attacker to recover administrative credentials and gain full administrative access, posing a significant risk to the device and potentially the wider network it is connected to.

Attack Chain

Attacker gains network access to the Taiko AG1000-01A SMS Alert Gateway device.
Attacker navigates to the device’s web configuration interface, typically accessible via a web browser.
The web browser downloads the login.zhtml page containing the client-side JavaScript code.
Attacker views the page source of login.zhtml.
Attacker identifies the validate() function within the JavaScript code.
Attacker extracts the hard-coded plaintext administrative credentials from the validate() function.
Attacker uses the recovered credentials to log in to the web configuration interface as an administrator.
Attacker gains full administrative control of the Taiko AG1000-01A SMS Alert Gateway device.

Impact

Successful exploitation of this vulnerability grants an attacker full administrative access to the Taiko AG1000-01A SMS Alert Gateway. This could lead to unauthorized modification of device settings, disruption of SMS alert services, or potential use of the device as a pivot point for further attacks within the network. Given the critical nature of alert gateways in many operational environments, the impact could range from missed alerts to significant operational disruptions.

Recommendation

Implement the following rule to detect access to the login page: “Detect Access to Taiko AG1000 Login Page”.
Deploy the “Detect Taiko AG1000 Login Attempt with Exposed Credentials” Sigma rule to your SIEM and tune for your environment.
Disable the web configuration interface on Taiko AG1000-01A SMS Alert Gateway devices if it is not required.
Apply provided patch or upgrade to a version of Taiko AG1000-01A SMS Alert Gateway that addresses CVE-2026-9139.