Taiko AG1000‑01A SMS Alert Gateway Rev 7.3 and Rev 8 contain a stored cross‑site scripting vulnerability that permits an authenticated attacker to embed persistent JavaScript in the device’s web configuration interface by fragmenting payloads across multiple administrative form fields. The attacker can bypass front‑end length restrictions using JavaScript comments and template literals, causing executable script fragments to be rendered in administrative dashboard views such as index.zhtml, which results in persistent script execution within administrative sessions. Persistent execution enables the attacker to run arbitrary scripts within the admin session, potentially compromising administrative data or escalating privileges.

The affected product is the Taiko Network Communications Pte Ltd. AG1000‑01A SMS Alert Gateway, available in revisions 7.3 and 8.

The CVSS score of 8.4 indicates high severity. EPSS score is not available, preventing a precise probability estimate, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers need authenticated accounts and access to the web configuration interface, making the threat largely confined to environments where local or remote administrative access is possible. Intruder exploitation could lead to unauthorized script execution within the admin context, enabling data theft or further compromise of the device.