Details of VAR-201702-0690

ID

VAR-201702-0690

CVE

CVE-2017-5137

TITLE

SendQuick Entera and Avera Unauthenticated on device SMS Vulnerability that requires logging

Trust: 0.8

sources: JVNDB: JVNDB-2017-001476

DESCRIPTION

An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the SMS logs from an unauthenticated perspective. SendQuick Entera & Avera SMS Gateway Appliances are prone to the following security vulnerabilities: 1. A denial-of-service vulnerability 2. An authentication bypass vulnerability. An attacker can exploit these issues to bypass certain security restrictions and perform unauthorized actions or cause denial-of-service conditions. TalariaX SendQuick Entera and Avera are products of TalariaX Company in Singapore. The former is a web-based server management system, and the latter is a plug-and-play network monitoring system

Trust: 1.98

sources: NVD: CVE-2017-5137 // JVNDB: JVNDB-2017-001476 // BID: 96031 // VULHUB: VHN-113340

AFFECTED PRODUCTS

vendor:	sendquick	model:	entera sms gateway	scope:	eq	version:	-	Trust: 1.6
vendor:	sendquick	model:	avera sms gateway	scope:	eq	version:	-	Trust: 1.6
vendor:	talariax pte	model:	sendquick avera	scope:	-	version:	-	Trust: 0.8
vendor:	talariax pte	model:	sendquick avera	scope:	lt	version:	2hf16	Trust: 0.8
vendor:	talariax pte	model:	sendquick entera	scope:	-	version:	-	Trust: 0.8
vendor:	talariax pte	model:	sendquick entera	scope:	lt	version:	2hf16	Trust: 0.8
vendor:	sendquick	model:	entera sms gateway	scope:	eq	version:	0	Trust: 0.3
vendor:	sendquick	model:	avera sms gateway	scope:	eq	version:	0	Trust: 0.3

sources: BID: 96031 // JVNDB: JVNDB-2017-001476 // CNNVD: CNNVD-201702-036 // NVD: CVE-2017-5137

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-5137
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-5137
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201702-036
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-113340
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-5137
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-113340
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-5137
baseSeverity:	MEDIUM
baseScore:	6.2
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.5
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-113340 // JVNDB: JVNDB-2017-001476 // CNNVD: CNNVD-201702-036 // NVD: CVE-2017-5137

PROBLEMTYPE DATA

problemtype:

CWE-532

Trust: 1.9

sources: VULHUB: VHN-113340 // JVNDB: JVNDB-2017-001476 // NVD: CVE-2017-5137

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201702-036

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201702-036

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-001476

PATCH

title:	sendQuick Avera	url:	http://www.talariax.com/web/avera.html	Trust: 0.8
title:	sendQuick Entera	url:	http://www.talariax.com/web/entera.html	Trust: 0.8
title:	TalariaX SendQuick Entera and Avera Repair measures for device security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=67424	Trust: 0.6

sources: JVNDB: JVNDB-2017-001476 // CNNVD: CNNVD-201702-036

EXTERNAL IDS

db:	NVD	id:	CVE-2017-5137	Trust: 2.8
db:	BID	id:	96031	Trust: 1.4
db:	JVNDB	id:	JVNDB-2017-001476	Trust: 0.8
db:	CNNVD	id:	CNNVD-201702-036	Trust: 0.7
db:	VULHUB	id:	VHN-113340	Trust: 0.1

sources: VULHUB: VHN-113340 // BID: 96031 // JVNDB: JVNDB-2017-001476 // CNNVD: CNNVD-201702-036 // NVD: CVE-2017-5137

REFERENCES

url:	https://niantech.io/blog/2017/02/05/vulns-multiple-vulns-in-sendquick-entera-avera-sms-gateway-appliances/	Trust: 2.8
url:	http://www.securityfocus.com/bid/96031	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5137	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-5137	Trust: 0.8
url:	http://www.sendquick.com.au	Trust: 0.3

sources: VULHUB: VHN-113340 // BID: 96031 // JVNDB: JVNDB-2017-001476 // CNNVD: CNNVD-201702-036 // NVD: CVE-2017-5137

CREDITS

NianTech.

Trust: 0.3

sources: BID: 96031

SOURCES

db:	VULHUB	id:	VHN-113340
db:	BID	id:	96031
db:	JVNDB	id:	JVNDB-2017-001476
db:	CNNVD	id:	CNNVD-201702-036
db:	NVD	id:	CVE-2017-5137

LAST UPDATE DATE

2025-04-20T23:22:30.439000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-113340	date:	2017-02-09T00:00:00
db:	BID	id:	96031	date:	2017-03-07T03:02:00
db:	JVNDB	id:	JVNDB-2017-001476	date:	2017-02-22T00:00:00
db:	CNNVD	id:	CNNVD-201702-036	date:	2017-02-06T00:00:00
db:	NVD	id:	CVE-2017-5137	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-113340	date:	2017-02-05T00:00:00
db:	BID	id:	96031	date:	2017-02-05T00:00:00
db:	JVNDB	id:	JVNDB-2017-001476	date:	2017-02-22T00:00:00
db:	CNNVD	id:	CNNVD-201702-036	date:	2017-02-06T00:00:00
db:	NVD	id:	CVE-2017-5137	date:	2017-02-05T18:59:00.227