What’s Vulnerable › Vulnerabilities

CVE-2017-20236: ProSoft Technology ICX35-HWC Command Injection via Web Interface

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-03 · updated 2026-07-21
• Weakness: CWE-78

Description

ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface that allows remote attackers to inject and execute system commands by submitting malicious input through unvalidated fields. Attackers can exploit this vulnerability to gain root privileges and execute arbitrary commands on the device through the accessible web interface.

Affected products

• ProSoft Technology ICX35-HWC Cellular Gateway: before 1.3 — fixed in 1.3

How to fix

Upgrade to a fixed version: ProSoft Technology ICX35-HWC Cellular Gateway 1.3. Check the vendor advisory for mitigations.

References

• https://assets.belden.com/m/1116a05ab702b2ba/original/Security-Bulletin-User-Interface-ProSoft-ICX35-BSECV-2017-10.pdf
• https://www.vulncheck.com/advisories/prosoft-technology-icx35-hwc-command-injection-via-web-interface

Get alerted when CVE-2017-20236 or the next vulnerability affects your stack