Vulnerability-Lookup

VAR-201703-0657

Vulnerability from variot - Updated: 2025-04-20 23:31

Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!". Eview EV-07S GPS There is an authentication vulnerability in the tracker firmware.Service operation interruption (DoS) An attack may be carried out. An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. Attackers can use SMS commands to exploit this vulnerability to restore factory settings

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201703-0657",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ev-07s gps tracker",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "eviewgps",
        "version": null
      },
      {
        "model": "ev-07s gps tracker",
        "scope": null,
        "trust": 0.8,
        "vendor": "eview",
        "version": null
      },
      {
        "model": "industrial limited ev-07s",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "eview",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "97186"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-430"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5237"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:eviewgps:ev-07s_gps_tracker_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Deral Heiland of Rapid7, Inc.",
    "sources": [
      {
        "db": "BID",
        "id": "97186"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-5237",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2017-5237",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-113440",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-5237",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-5237",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-5237",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201701-430",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-113440",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-113440"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-430"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5237"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker\u0027s phone number can revert the device to a factory default configuration with an SMS command, \"RESET!\". Eview EV-07S GPS There is an authentication vulnerability in the tracker firmware.Service operation interruption (DoS) An attack may be carried out. \nAn attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. Attackers can use SMS commands to exploit this vulnerability to restore factory settings",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-5237"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      },
      {
        "db": "BID",
        "id": "97186"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113440"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-5237",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "97186",
        "trust": 1.4
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-430",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-113440",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-113440"
      },
      {
        "db": "BID",
        "id": "97186"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-430"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5237"
      }
    ]
  },
  "id": "VAR-201703-0657",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-113440"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-20T23:31:03.084000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "EV07S Personal/Asset Tracking System",
        "trust": 0.8,
        "url": "http://www.eviewltd.com/#/products/ev07s.jsp"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-287",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-113440"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5237"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/97186"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5237"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5237"
      },
      {
        "trust": 0.3,
        "url": "http://www.eviewltd.com/#/products/ev07s.jsp"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-113440"
      },
      {
        "db": "BID",
        "id": "97186"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-430"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5237"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-113440"
      },
      {
        "db": "BID",
        "id": "97186"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-430"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5237"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-03-27T00:00:00",
        "db": "VULHUB",
        "id": "VHN-113440"
      },
      {
        "date": "2017-03-27T00:00:00",
        "db": "BID",
        "id": "97186"
      },
      {
        "date": "2017-04-26T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      },
      {
        "date": "2017-01-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201701-430"
      },
      {
        "date": "2017-03-27T21:59:00.143000",
        "db": "NVD",
        "id": "CVE-2017-5237"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-03-31T00:00:00",
        "db": "VULHUB",
        "id": "VHN-113440"
      },
      {
        "date": "2017-04-04T00:01:00",
        "db": "BID",
        "id": "97186"
      },
      {
        "date": "2017-04-26T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      },
      {
        "date": "2017-03-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201701-430"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-5237"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-430"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Eview EV-07S GPS Authentication vulnerability in tracker firmware",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002727"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "authorization issue",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-430"
      }
    ],
    "trust": 0.6
  }
}

CVE-2017-5237 (GCVE-0-2017-5237)

Vulnerability from cvelistv5 – Published: 2017-03-27 21:00 – Updated: 2024-08-05 14:55

Summary

Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!"

Severity ?

No CVSS data available.

CWE

Unauthenticated remote factory reset

Assigner

rapid7

References

URL

Tags

	https://community.rapid7.com/community/infosec/bl…	x_refsource_MISC
	http://www.securityfocus.com/bid/97186	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	Eview	EV-07S GPS Tracker	Affected: All

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:55:35.682Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities"
          },
          {
            "name": "97186",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97186"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EV-07S GPS Tracker",
          "vendor": "Eview",
          "versions": [
            {
              "status": "affected",
              "version": "All"
            }
          ]
        }
      ],
      "datePublic": "2017-03-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker\u0027s phone number can revert the device to a factory default configuration with an SMS command, \"RESET!\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unauthenticated remote factory reset",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-03-30T09:57:01",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities"
        },
        {
          "name": "97186",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97186"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@rapid7.com",
          "ID": "CVE-2017-5237",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EV-07S GPS Tracker",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Eview"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker\u0027s phone number can revert the device to a factory default configuration with an SMS command, \"RESET!\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Unauthenticated remote factory reset"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities",
              "refsource": "MISC",
              "url": "https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities"
            },
            {
              "name": "97186",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97186"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2017-5237",
    "datePublished": "2017-03-27T21:00:00",
    "dateReserved": "2017-01-09T00:00:00",
    "dateUpdated": "2024-08-05T14:55:35.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201703-0657

CVE-2017-5237 (GCVE-0-2017-5237)

Tags

Sightings

Nomenclature