ProSoft Technology ICX35-HWC Authentication Bypass

Published 7 mo ago 2026-04-03 · modified 3 mo ago 2026-07-21 · JSON

CVSS

9.1

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.5%

percentile 40%

Public exploits

none known

ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unauthenticated attackers to gain access to administrative functions without valid credentials. Attackers can bypass the authentication mechanism in affected firmware versions to obtain full administrative access to device configuration and settings.

CISA SSVC assessment

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 7 mo ago 2026-04-06

Exploit prediction (EPSS)

0.46% probability of exploitation in the next 30 days, higher than 40% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	9.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
CNA	4.0	9.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
CNA	4.0	9.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	9.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
NVD	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

ProSoft Technology ICX35-HWC Cellular Gateway

Classification

Weakness

CWE-287 Improper Authentication

References

assets.belden.com /m/1281cac2c9e90abf/original/Security-Bulletin-Authentication-Security-ProSoft-ICX35-BSECV · vendor-advisory
vulncheck.com /advisories/prosoft-technology-icx35-hwc-authentication-bypass · third-party-advisory

Sources

CVE List: CVE-2017-20235
NVD: CVE-2017-20235

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary