XSS in Taiko Network Communications Pte Ltd. Ag1000-01a Sms Alert Gateway
CVE-2026-9144
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields. Attackers can bypass front-end length restrictions using JavaScript comments and template literals to concatenate executable script fragments that are rendered in administrative dashboard views such as index.zhtml, resulting in persistent script execution within administrative sessions.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.005 (38.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 38.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000
Affected products
- Taiko Network Communications Pte Ltd. Ag1000-01a Sms Alert Gateway — versions Rev 7.3, Rev 8, UM-AG1000_R7.2
Weakness classification (CWE)
References
- medium.com/@forgetmen0t/multiple-vulnerabilities-in-taiko-ag1000-01a-sms-alert-… (technical-description)
- www.vulncheck.com/advisories/taiko-ag1000-01a-rev-8-stored-xss-via-web-configur… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-9144?
- CVE-2026-9144 is a high-severity vulnerability in Taiko Network Communications Pte Ltd. Ag1000-01a Sms Alert Gateway, classified under Cross-site Scripting. CVSS score: 7.6/10. Published 2026-05-20.
- How severe is CVE-2026-9144?
- High severity. CVSS v3 base score is 7.6 out of 10.