CVE-2017-20236
CRITICALProSoft Technology ICX35-HWC Command Injection via Web Interface
Title source: cnaDescription
ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface that allows remote attackers to inject and execute system commands by submitting malicious input through unvalidated fields. Attackers can exploit this vulnerability to gain root privileges and execute arbitrary commands on the device through the accessible web interface.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
https://assets.belden.com/m/1116a05ab702b2ba/original/Security-Bulletin-User-Interface-ProSoft-ICX35-BSECV-2017-10.pdf
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/prosoft-technology-icx35-hwc-command-injection-via-web-interface
Scores
CVSS v3
9.8
EPSS
0.0068
EPSS Percentile
47.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (7)
ProSoft Technology/ICX35-HWC Cellular Gateway
< 1.0
ProSoft Technology/ICX35-HWC Cellular Gateway
< 1.1
ProSoft Technology/ICX35-HWC Cellular Gateway
< 1.1d
ProSoft Technology/ICX35-HWC Cellular Gateway
< 1.2.x
ProSoft Technology/ICX35-HWC Cellular Gateway
< 1.3
ProSoft Technology/ICX35-HWC Cellular Gateway
1.3
prosoft-technology/icx35-hwc_firmware
< 1.3
Published
Apr 03, 2026
Tracked Since
Apr 04, 2026