CVE Feed

    Dashboard / CVE / CVE-2026-9139

    CVE-2026-9139

    Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.

    Published:May 20, 2026
    Last Modified:Jul 28, 2026
    EPS:May 20, 2026
    EPSS Score:0.00454
    CVSS Score:9.8

    Affected Products

    Vendor
    Oracle
    Product
    Communications Application Session Controller
    Vendor
    Taiko
    Product
    Ag1000-01a Sms Alert Gateway

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2026-9144 (CVSS 8.4) — Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in t…
    CVE-2026-9141 (CVSS 9.3) — Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the em…
    CVE-2021-2351 (CVSS 8.3) — Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that a…
    CVE-2021-29425 (CVSS 4.8) — In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input strin…
    CVE-2020-11987 (CVSS 8.2) — Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the Nod…
    CVE-2020-28052 (CVSS 8.1) — An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword …
    CVE-2020-27216 (CVSS 7) — In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 1…
    CVE-2019-17566 (CVSS 7.5) — Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:h…
    CVE-2020-9488 (CVSS 3.7) — Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS…
    CVE-2020-11022 (CVSS 6.9) — In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing i…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High