sgwbox N3 CVE-2025-14703

Exploitation requires network reachability to the sgwbox N3's web management interface and the ability to send a POST request to the /fsnotify endpoint of the POST Message Handler with a manipulated 'token' argument; per CVSS PR:N/UI:N no valid credentials or user interaction are needed. The practical LIMITING factor is exposure and footprint, not technical difficulty: the affected product is a niche NAS appliance (sgwbox N3 firmware 2.0.25) with a very small installed base, and devices are only at risk if their web interface is reachable by the attacker (internet-exposed or on the same network). No patch is available because the vendor did not respond to disclosure, so defenders must rely on network isolation/access control.

This is a MEDIUM-severity (CVSS 4.0 base 5.5) authentication-bypass issue that is real but low-priority in practice. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, which is the worst-case exploitability profile - yet the impact metrics are deliberately modest (VC:L/VI:N/VA:N), meaning only limited confidentiality exposure and no integrity or availability impact, consistent with partial authentication bypass via the 'token' parameter rather than full device takeover. Signals are mixed: a public exploit exists (POC=YES, a Notion write-up), but the CVE is NOT on CISA KEV and EPSS is only 0.68% (51st percentile), indicating no evidence of widespread or automated exploitation despite the POC. The CVSS 4.0 vector carries E:P (Proof-of-Concept), corroborating the POC signal rather than active exploitation. The combination of a niche vendor (VulDB-sourced, vendor non-responsive) and low EPSS suggests this is an opportunistic/targeted concern for the small population of exposed devices, not a broad emergency. Note the limitation: the impact rating (VC:L) is modest, so this is a genuine-but-contained flaw rather than a high-real-risk, high-CVSS issue; verify exact exposed data with the vendor, which is difficult given the vendor did not respond to disclosure.

An attacker who can reach the device's web interface over the network sends a crafted POST request to the /fsnotify endpoint with a manipulated 'token' argument, bypassing authentication checks to access functionality or limited information that should require valid credentials. A public proof-of-concept write-up describing this NAS N3 auth bypass has been disclosed, lowering the barrier to replication. Because no user interaction or prior privileges are needed (PR:N/UI:N), exploitation is straightforward against any internet- or LAN-exposed device.