Log in Start free

Vulnerability · Published May 20, 2026 · Assigned by VulnCheck

CVE-2026-9141Taiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web Interface

Critical 9.8

In plain English

A critical-severity missing authentication in AG1000-01A SMS Alert Gateway from Taiko Network Communications Pte Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 58.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenticated attackers to access internal application pages without any session management or server-side authentication checks. Attackers with network access can directly request internal resources such as index.zhtml, point.zhtml, and log.shtml to gain full administrative read and write access, enabling unauthorized modification of alarm routing, device configuration, and disruption of monitoring and control functions.

Affected products (as reported)

VendorProductVersions
Taiko Network Communications Pte Ltd. AG1000-01A SMS Alert Gateway Rev 7.3Rev 8UM-AG1000_R7.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References