The Taiko AG1000-01A SMS Alert Gateway contains a stored XSS vulnerability in its embedded web configuration interface. Authenticated attackers can fragment malicious JavaScript payloads across multiple form fields, bypassing input length restrictions by using JavaScript comments and template literals. These payload fragments are concatenated and executed persistently in administrative dashboard views, including index.zhtml. This vulnerability affects versions Rev 7.3, Rev 8, and UM-AG1000_R7.2 of the product. The CVSS 3.1 base score is 7.6, indicating high severity, with network attack vector, low attack complexity, requiring privileges and user interaction, and impacting confidentiality, integrity, and availability.

Successful exploitation allows authenticated attackers to execute persistent JavaScript within administrative sessions, potentially leading to unauthorized actions, data theft, or session hijacking in the administrative interface. The vulnerability impacts confidentiality and integrity with high severity and causes low impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a patch is available, restrict administrative access to trusted users only and monitor for suspicious activity. Avoid exposing the web configuration interface to untrusted networks.