CVE-2017-20235
Authentication Bypass in ProSoft ICX35-HWC Enables Admin Access
Publication date: 2026-04-03
Last updated on: 2026-04-22
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| prosoft-technology | icx35-hwc_firmware | to 1.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in ProSoft Technology ICX35-HWC version 1.3 and earlier cellular gateways. It is an authentication bypass flaw in the web user interface that allows attackers who are not authenticated to gain access to administrative functions without needing valid credentials.
By exploiting this vulnerability, attackers can bypass the authentication mechanism and obtain full administrative access to the device's configuration and settings.
How can this vulnerability impact me? :
The impact of this vulnerability is severe because it allows unauthenticated attackers to gain full administrative access to the affected device.
- Attackers can change device configurations and settings.
- Unauthorized access could lead to compromise of network security.
- Potential disruption of device operation or misuse of the device for malicious purposes.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to gain full administrative access to device configuration and settings by bypassing authentication mechanisms. This unauthorized access could lead to exposure or manipulation of sensitive data, potentially violating data protection requirements under standards like GDPR and HIPAA.
Such a security flaw undermines the confidentiality and integrity of data managed by the device, which are core principles in many compliance frameworks. Organizations using affected devices may face increased risk of non-compliance due to inadequate access controls.