Vulnerability · Published May 20, 2026 · Assigned by VulnCheck

CVE-2026-9139Taiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml

Critical 9.8

In plain English

A critical-severity hard-coded credentials in AG1000-01A SMS Alert Gateway from Taiko Network Communications Pte Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.

Affected products (as reported)

Vendor	Product	Versions
Taiko Network Communications Pte Ltd.	AG1000-01A SMS Alert Gateway	Rev 7.3Rev 8UM-AG1000_R7.2

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Ledger Security Bulletin 019 technical-description
https://www.vulncheck.com/advisories/taiko-ag1000-01a-rev-8-hard-coded-credentials-via-login-zhtml third-party-advisory