PT-2026-42264 · Taiko · Ag1000-01A Sms Alert Gateway

Vulncheck · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-9144

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Taiko AG1000-01A SMS Alert Gateway version 7.3 Taiko AG1000-01A SMS Alert Gateway version 8

Description The embedded web configuration interface contains a stored cross-site scripting (XSS) issue, which is a flaw that allows an attacker to inject malicious scripts into a web page viewed by other users. Authenticated attackers can execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields. By using JavaScript comments and template literals, attackers can bypass front-end length restrictions to concatenate executable script fragments. These fragments are then rendered in administrative dashboard views, such as the 'index.zhtml' endpoint, leading to persistent script execution within administrative sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9144

Affected Products

Ag1000-01A Sms Alert Gateway

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9144 · Security Note
• https://vulncheck.com/advisories/taiko-ag1000-01a-rev-8-stored-xss-via-web-configuration-interface · Note
• https://t.me/CVEtracker/54438 · Telegram Post
• https://medium.com/@forgetmen0t/multiple-vulnerabilities-in-taiko-ag1000-01a-sms-alert-gateway-82095b1d633e · Note