CVE-2017-20235

Received Received - Intake

Authentication Bypass in ProSoft ICX35-HWC Enables Admin Access

Publication date: 2026-04-03

Last updated on: 2026-04-22

Assigner: VulnCheck

Description

ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unauthenticated attackers to gain access to administrative functions without valid credentials. Attackers can bypass the authentication mechanism in affected firmware versions to obtain full administrative access to device configuration and settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-03

Last Modified

2026-04-22

Generated

2026-07-06

AI Q&A

2026-04-04

EPSS Evaluated

2026-07-05

NVD

CVE-2017-20235

EUVD

EUVD-2017-18960

Affected Vendors & Products

Vendor	Product	Version / Range
prosoft-technology	icx35-hwc_firmware	to 1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ProSoft Technology ICX35-HWC version 1.3 and earlier cellular gateways. It is an authentication bypass flaw in the web user interface that allows attackers who are not authenticated to gain access to administrative functions without needing valid credentials.

By exploiting this vulnerability, attackers can bypass the authentication mechanism and obtain full administrative access to the device's configuration and settings.

Impact Analysis

The impact of this vulnerability is severe because it allows unauthenticated attackers to gain full administrative access to the affected device.

Attackers can change device configurations and settings.
Unauthorized access could lead to compromise of network security.
Potential disruption of device operation or misuse of the device for malicious purposes.

Compliance Impact

The vulnerability allows unauthenticated attackers to gain full administrative access to device configuration and settings by bypassing authentication mechanisms. This unauthorized access could lead to exposure or manipulation of sensitive data, potentially violating data protection requirements under standards like GDPR and HIPAA.

Such a security flaw undermines the confidentiality and integrity of data managed by the device, which are core principles in many compliance frameworks. Organizations using affected devices may face increased risk of non-compliance due to inadequate access controls.

Hi! I’m here to help you understand CVE-2017-20235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70