CVE-2026-9141 Details

An authentication bypass vulnerability has been identified in the Taiko AG1000-01A SMS Alert Gateway, specifically in versions through Rev 8. This vulnerability resides in the embedded web configuration interface, allowing unauthenticated attackers to access internal application pages without any session management or server-side authentication checks. With network access, attackers can directly request internal resources such as index.zhtml, point.zhtml, and log.shtml. Exploiting this vulnerability grants full administrative read and write access, enabling unauthorized modifications of alarm routing, device configuration, and disruption of monitoring and control functions.

No official security patches or firmware updates are expected, as the vendor appears to be inactive. Organizations are advised to isolate the device from internet-facing networks, place it in a non-routing Management VLAN, and require secure VPN access for remote configuration.