CVE-2017-20236 ProSoft Technology ICX35-HWC Command Injection via Web Interface

CriticalCVSS 9.3 EPSS 0.70%

Published: 2026-04-04 01:54
Updated: 2026-07-21 10:10
Exploit status: No public exploit known

Description

ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface that allows remote attackers to inject and execute system commands by submitting malicious input through unvalidated fields. Attackers can exploit this vulnerability to gain root privileges and execute arbitrary commands on the device through the accessible web interface.

Affected products

Product	Affected versions	Fixed in
ProSoft Technology ICX35-HWC Cellular Gateway	<= 1.3	No fix listed
prosoft-technology icx35-hwc firmware	< 1.3	1.3

References

assets.belden.com vendor-advisory
www.vulncheck.com third-party-advisory

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (4)

v4.0 9.3 · vulncheck
v4.0 9.3 · disclosure@vulncheck.com
v3.1 9.8 · vulncheck
v3.1 9.8 · disclosure@vulncheck.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.70% (percentile 53.5)
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.