CVE-2026-9139 Taiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml
Hard-coded credentials in client-side JavaScript allow unauthenticated attackers to gain full administrative access to the Taiko SMS Alert Gateway.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9139?
CVE-2026-9139 is a critical vulnerability in Taiko Network Communications Pte Ltd. AG1000-01A SMS Alert Gateway, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.
Weakness: CWE-798
Which versions are affected by CVE-2026-9139?
How do I fix CVE-2026-9139?
No fix has been published for CVE-2026-9139 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9139 being exploited?
There is no known exploitation of CVE-2026-9139 in the wild and no public exploit code.
Sources
Also known as GHSA-jj2w-phrm-32r8.