PT-2026-42263 · Taiko · Ag1000-01A Sms Alert Gateway

Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-9141

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Taiko AG1000-01A SMS Alert Gateway Rev 7.3 Taiko AG1000-01A SMS Alert Gateway Rev 8

Description An authentication bypass exists in the embedded web configuration interface. This flaw allows unauthenticated attackers with network access to access internal application pages because the system lacks session management and server-side authentication checks. By directly requesting internal resources such as 'index.zhtml', 'point.zhtml', and 'log.shtml', attackers can obtain full administrative read and write access. This can lead to unauthorized modification of alarm routing and device configuration, as well as the disruption of monitoring and control functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-9141

Affected Products

Ag1000-01A Sms Alert Gateway

References · 5

• 🔥 https://medium.com/@forgetmen0t/multiple-vulnerabilities-in-taiko-ag1000-01a-sms-alert-gateway-82095b1d633e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9141 · Security Note
• https://twitter.com/OrizonCyber/status/2057234939863527627 · Twitter Post
• https://t.me/CVEtracker/54437 · Telegram Post
• https://vulncheck.com/advisories/taiko-ag1000-01a-rev-8-authentication-bypass-via-web-interface · Note