PT-2025-51201 · Shiguangwu · Sgwbox N3

Rgyue · Published 2025-12-15 · Updated 2025-12-23 · CVE-2025-14707

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Shiguangwu sgwbox N3 version 2.0.25

Description A security flaw exists in Shiguangwu sgwbox N3 2.0.25 within the DOCKER Feature. Manipulation of the params argument in an unknown function of the file /usr/sbin/http eshell server can lead to command injection. This issue is remotely exploitable. The exploit has been publicly released, and the vendor has not responded to reports about this disclosure.

Recommendations Restrict access to the /usr/sbin/http eshell server file. As a temporary workaround, consider disabling the DOCKER Feature until a patch is available. Monitor network traffic for suspicious activity related to the affected component.

Exploit

Fix

RCE

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-14707

Affected Products

Sgwbox N3

References · 14

• 🔥 https://notion.so/sgwbox-NAS-N3-Command-Injection-2be6cf4e528a805f9b94f7b8799c77a8?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14707 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14707 · Vendor Advisory
• https://vuldb.com/?submit.706976 · Note
• https://twitter.com/TheHackerWire/status/2000462881041846650 · Twitter Post
• https://vuldb.com/?ctiid.336424 · Note
• https://t.me/cveNotify/146680 · Telegram Post
• https://t.me/cveNotify/145746 · Telegram Post
• https://twitter.com/CveFindCom/status/2000455521036349442 · Twitter Post
• https://twitter.com/0dayPublishing/status/2000448342854136306 · Twitter Post
• https://twitter.com/CVEnew/status/2000611223440965972 · Twitter Post
• https://t.me/CVEtracker/39808 · Telegram Post
• https://vuldb.com/?id.336424 · Note
• https://twitter.com/offseq/status/2000514461875290436 · Twitter Post