CVE-2017-20235 is an authentication bypass vulnerability in the web user interface of ProSoft Technology's ICX35-HWC industrial cellular gateway, a device ProSoft markets for Water & Wastewater remote telemetry among its other industrial solutions: a remote, unauthenticated attacker can bypass the login screen on firmware 1.2.x and earlier to obtain full administrative access to the device, and NVD rates the flaw 9.8 (critical) on CVSS v3.1.
Vulnerability summary
9.8
Critical
0.5%
EPSS score (FIRST)
No
CISA KEV catalog
2026-04-03
Published
Vulnerability ID: CVE-2017-20235 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| ProSoft Technology ICX35-HWC Industrial Cellular Gateway firmware (web user interface) | cpe:2.3:o:prosoft-technology:icx35-hwc_firmware:*:*:*:*:*:*:*:* | Firmware versions 1.0, 1.1, 1.1d and 1.2.x (before 1.3); fixed in firmware 1.3, released 12 April 2017, per Belden/ProSoft Security Bulletin BSECV-2017-9 |
What does this mean for affected devices?
CVE-2017-20235 (CWE-287, improper authentication) affects the ICX35-HWC industrial cellular gateway from ProSoft Technology, which lists Water & Wastewater among the industry solutions its remote-access and wireless gateway products serve (ProSoft Technology).
NVD's description states: "ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unauthenticated attackers to gain access to administrative functions without valid credentials. Attackers can exploit this vulnerability in affected firmware versions to obtain full administrative access to device configuration and settings" (NVD).
VulnCheck, the CVE Numbering Authority that disclosed the flaw, rated it CVSS v3.1 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and CVSS v4.0 9.3, while NVD's own Primary analysis scores it higher, at 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — the difference is the availability impact: NVD rates full administrative access as capable of denying availability (A:H) as well as confidentiality and integrity, where VulnCheck's vector rates availability impact as none (A:N) (NVD).
Although the CVE identifier is dated 2017, it was not published to NVD until 2026: the underlying flaw was originally disclosed by ProSoft's parent company Belden in Security Bulletin BSECV-2017-9 ("ICX35 Authentication Vulnerability," dated 4 May 2017), which states the bug was "identified during internal comprehensive penetration testing," affects ICX35-HWC-x firmware 1.0, 1.1, 1.1d and 1.2.x, and was fixed in firmware 1.3, released 12 April 2017; a CVE ID for that bulletin was only assigned by VulnCheck's retroactive disclosure program years later (Belden/ProSoft Security Bulletin BSECV-2017-9, VulnCheck Advisory).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00459 (40.0th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Any ICX35-HWC cellular gateway still running firmware older than 1.3 — including units deployed for remote water/wastewater lift-station or well-site telemetry over cellular links — should be updated to firmware 1.3 or later per Belden's bulletin, and management access to the device's web interface should be restricted to trusted networks in the meantime.
Evidence
- ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain a web-UI authentication bypass letting unauthenticated attackers reach administrative functions and obtain full administrative access to device configuration and settings. — NVD
- VulnCheck (CNA) scored it CVSS v3.1 9.1 / v4.0 9.3; NVD's own Primary rating is CVSS v3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
- Belden/ProSoft Security Bulletin BSECV-2017-9 (4 May 2017): vulnerability found during internal penetration testing, affects ICX35-HWC-x firmware 1.0/1.1/1.1d/1.2.x, fixed in firmware 1.3 released 12 April 2017. — Belden/ProSoft Security Bulletin BSECV-2017-9
- ProSoft Technology lists Water & Wastewater among the industry solutions its gateway and remote-access products serve. — ProSoft Technology
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00459 (40.0th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What can an unauthenticated attacker do by exploiting this authentication bypass?
NVD's description states that unauthenticated attackers can bypass the ICX35-HWC web interface's login to "gain access to administrative functions without valid credentials" and "obtain full administrative access to device configuration and settings" on firmware 1.3 and prior (per NVD).
Why is a CVE identifier from 2017 only being published now, in 2026?
The underlying bug was originally found by ProSoft's parent company Belden during internal penetration testing and disclosed in Security Bulletin BSECV-2017-9 back in May 2017; a formal CVE ID for that same bulletin was only assigned later through VulnCheck's retroactive disclosure program, which is why the identifier reads 2017 but the NVD publication date is 2026 (per Belden/ProSoft Security Bulletin BSECV-2017-9; per VulnCheck Advisory).
Do different scoring sources agree on how severe this is?
Not exactly. VulnCheck, the CVE Numbering Authority, rated it CVSS v3.1 9.1 and v4.0 9.3 with no availability impact (A:N), while NVD's own Primary analysis scores it higher at 9.8, rating full administrative access as capable of denying availability (A:H) as well as confidentiality and integrity (per NVD).
Where is the ICX35-HWC gateway typically deployed, and how is it fixed?
ProSoft Technology lists Water & Wastewater among the industry solutions its cellular gateway products serve, meaning affected units can be found providing remote telemetry at lift stations or well sites; the fix is firmware 1.3, released 12 April 2017 per Belden's bulletin, and the web management interface should be restricted to trusted networks until the device is updated (per Belden/ProSoft Security Bulletin BSECV-2017-9; per ProSoft Technology).