PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10098 Sendquick CVE debrief

CVE-2016-10098 is a critical command injection vulnerability affecting SendQuick Entera and Avera SMS gateway appliances before 2HF16. The issue is documented as allowing attackers to execute arbitrary system commands, and NVD classifies it as remotely reachable with no authentication and no user interaction required. Organizations using these appliances should treat exposed management or service interfaces as high risk until the affected firmware is identified and remediated.

Vendor
Sendquick
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-05
Original CVE updated
2026-05-13
Advisory published
2017-02-05
Advisory updated
2026-05-13

Who should care

Security teams, network administrators, and operations staff responsible for SendQuick Entera or Avera SMS gateway appliances should prioritize this issue, especially if the devices are reachable from untrusted networks or used in sensitive messaging workflows.

Technical summary

The published vulnerability data describes multiple command injection flaws in SendQuick Entera and Avera devices running firmware before 2HF16. NVD assigns CWE-77 and a CVSS 3.0 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploitable issue with no privileges or user interaction required and the potential for full confidentiality, integrity, and availability impact. The source corpus also links a third-party advisory and a SecurityFocus BID reference.

Defensive priority

Immediate. The combination of remote reachability, no authentication, and high impact places this issue in the highest remediation tier for affected environments.

Recommended defensive actions

  • Inventory all SendQuick Entera and Avera SMS gateway appliances and confirm firmware versions.
  • Identify any systems running firmware before 2HF16 and prioritize them for remediation.
  • Apply vendor guidance or firmware updates that move devices beyond the affected pre-2HF16 range, if available.
  • Restrict network access to appliance management and service interfaces to trusted administrative segments only.
  • Monitor logs and telemetry for signs of unexpected command execution or unusual appliance behavior.
  • If a device cannot be updated promptly, isolate it and plan replacement or compensating controls.

Evidence notes

Primary details come from the NVD record for CVE-2016-10098, which lists affected SendQuick Entera SMS Gateway firmware and SendQuick Avera SMS Gateway firmware, both vulnerable before 2HF16, and maps the weakness to CWE-77. The supplied CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The corpus also includes a SecurityFocus BID 96129 reference and a third-party advisory link from Niantech. No KEV entry is provided in the supplied enrichment.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10098 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10098

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10098 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10098

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://niantech.io/blog/2017/02/05/vulns-multiple-vulns-in-sendquick-entera-avera-sms-gateway-appliances/

    [email protected] - Press/Media Coverage, Third Party Advisory, URL Repurposed

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.