CVE-2026-9139: CWE-798 Use of Hard-coded Credentials in Taiko Network Communications Pte Ltd. AG1000-01A SMS Alert Gateway
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.
AI Analysis
Technical Summary
CVE-2026-9139 identifies a CWE-798 vulnerability in Taiko Network Communications Pte Ltd.'s AG1000-01A SMS Alert Gateway Rev 7.3. The embedded web configuration interface implements authentication entirely in client-side JavaScript within login.zhtml, exposing static plaintext credentials in the client-side validate() function. This design flaw enables unauthenticated attackers on the network to extract administrative credentials from the page source and gain full administrative access to the device.
Potential Impact
Successful exploitation results in full administrative access to the affected device, compromising confidentiality, integrity, and availability. Attackers can control device configuration and potentially disrupt SMS alert services or manipulate sensitive data.
Mitigation Recommendations
No official patch or remediation is currently available. Users should restrict network access to the device's management interface to trusted administrators only and monitor for unauthorized access attempts. Check the vendor advisory regularly for updates regarding fixes or mitigations.
CVE-2026-9139: CWE-798 Use of Hard-coded Credentials in Taiko Network Communications Pte Ltd. AG1000-01A SMS Alert Gateway
Description
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.
CVSS v3.1
Score 9.8critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-9139 identifies a CWE-798 vulnerability in Taiko Network Communications Pte Ltd.'s AG1000-01A SMS Alert Gateway Rev 7.3. The embedded web configuration interface implements authentication entirely in client-side JavaScript within login.zhtml, exposing static plaintext credentials in the client-side validate() function. This design flaw enables unauthenticated attackers on the network to extract administrative credentials from the page source and gain full administrative access to the device.
Potential Impact
Successful exploitation results in full administrative access to the affected device, compromising confidentiality, integrity, and availability. Attackers can control device configuration and potentially disrupt SMS alert services or manipulate sensitive data.
Mitigation Recommendations
No official patch or remediation is currently available. Users should restrict network access to the device's management interface to trusted administrators only and monitor for unauthorized access attempts. Check the vendor advisory regularly for updates regarding fixes or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-20T19:04:51.690Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0e173eba1db47362a37eb5
Added to database: 05/20/2026, 20:19:10 UTC
Last enriched: 07/30/2026, 00:49:10 UTC
Last updated: 07/31/2026, 19:30:19 UTC
Views: 101
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.