CVE-2017-20236

critical · 9.3

ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface that allows remote attackers to inject and execute system commands by submitting malicious input through unvalidated fields. Attackers can exploit this vulnerability to gain root privileges and execute arbitrary commands on the device through the accessible web interface.

9.3

CVSS

0.7%

EPSS (exploit prob.)

51st

EPSS percentile

2026-04-03

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
prosoft-technology	icx35-hwc_firmware	< 1.3
prosoft-technology	icx35-hwc	all versions

Check a specific version with /api/v1/cve/match.

References

https://assets.belden.com/m/1116a05ab702b2ba/original/Security-Bulletin-User-Interface-ProSoft-ICX35-BSECV-2017-10.pdf
https://www.vulncheck.com/advisories/prosoft-technology-icx35-hwc-command-injection-via-web-interface

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-20236