CVE-2017-20235: Auth Bypass in ProSoft ICX35-HWC Gateways

CVE-2017-20235 is a critical authentication bypass (CVSS 9.1) in the web interface of the ProSoft Technology ICX35-HWC cellular gateway. ProSoft's bulletin BSECV-2017-9 says firmware 1.3, released 12 April 2017, fixes it. Update every ICX35 gateway to firmware 1.3 or later.

What's affected

• Product: ProSoft Technology ICX35-HWC cellular gateways (ICX35-HWC-x).
• Affected firmware per the vendor bulletin: 1.0, 1.1, 1.1d and 1.2.x.
• Fixed: firmware 1.3, released 12 April 2017, per the bulletin.
• Version note: the NVD text says "version 1.3 and prior", while the vendor bulletin says 1.3 contains the fix. Follow the vendor and verify on the device.
• Weakness: CWE-287, improper authentication.
• CVSS 9.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

How to check if you're exposed

Check the firmware version in the gateway's web interface, or through ProSoft Connect if you manage the fleet there. Compare it with the affected list above.

Then check reachability. The flaw is in the web user interface, so ask whether that interface can be reached from outside the management network. Look at your firewall rules and any cellular carrier port forwarding for the gateway's web port. Check that the admin interface is not published to the internet.

What to do now

1. Inventory every ICX35 gateway and record its firmware version.
2. Update to 1.3 or later through ProSoft Connect, or by downloading firmware from the ICX35 product page, as the bulletin describes.
3. Restrict the web interface to a management network or VPN.
4. Review gateway configuration for changes you did not make, including credentials, routes and remote access settings.
5. Rotate the admin credentials after the update.
6. Record the firmware version in your asset register so the next audit shows it.

Why it matters

These gateways sit between industrial equipment and a cellular network. The bulletin says an unauthenticated attacker could reach the administrative functions and gain full administrator access to the gateway configuration. Configuration control of an edge device can change where traffic goes.

The vendor describes finding the problem during internal penetration testing. The CISA KEV flag is false and I found no report of exploitation. The issue is older than its CVE, since the bulletin dates from May 2017 and the CVE was published in April 2026, so older fleets are the likely place it is still present.

Quick check

Sources

• ProSoft security bulletin BSECV-2017-9
• VulnCheck advisory
• Gold record for CVE-2017-20235

Last reviewed: 19 October 2026.