sgwbox N3 Firmware CVE-2025-14704
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRecon target IP
-
DeliverySend crafted HTTP GET to /eshell with path traversal
-
ExploitServer returns requested file
-
ExecutionAttacker collects sensitive data
-
ImpactLateral movement if credentials found
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against the /eshell endpoint of sgwbox N3 firmware 2.0.25 is possible. Limiting factors: the attack requires network connectivity to the device (often internal LAN), and the endpoint must be accessible (default config likely exposes the API). Authentication requirements not confirmed from available data. |
| Impact | CVSS 4.0 base score 5.5 (medium) with AV:N/AC:L/PR:N/UI:N indicates trivial remote exploitation with no authentication. EPSS at 0.42% (62nd percentile) suggests moderate likelihood of exploitation. The public exploit and absence of vendor response elevate risk, but the low impacts and lack of KEV confirmation imply limited real-world urgency-attack surface is confined to a niche NAS device with read-only impact. No signal conflict: all indicators consistently point to a moderate risk that may increase if wormable or if devices are exposed to the internet. |
| Exploit ScenarioDerived | An attacker with network access to the sgwbox N3 sends a GET request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Path traversal vulnerability in Shiguangwu sgwbox N3 NAS firmware 2.0.25 allows remote unauthenticated attackers to read arbitrary files via the /eshell API endpoint. A public exploit is available, and no vendor patch exists yet. EPSS score of 0.42% indicates moderate exploitation probability, though no active exploitation is currently confirmed (no CISA KEV listing).
RemediationAI
No vendor-released patch identified at time of analysis; the vendor did not respond to disclosure. As a compensating control, block network access to the /eshell endpoint (e.g., via firewall rules or reverse proxy ACLs) or restrict it to trusted internal IPs only. Deploy a web application firewall (WAF) rule to block path traversal patterns (e.g., '../' sequences). Monitor logs for suspicious requests to /eshell. Trade-off: blocking the endpoint may disrupt legitimate functionality if any, which is unknown.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic path traversal (CWE-22) affecting the /eshell endpoint of the sgwbox N3 API. The CPE string cpe:2.3:o:sgwbox:n3_firmware:* indicates the impact is limited to the N3 model's firmware. Path traversal occurs when user-supplied filenames are not properly sanitized, allowing an attacker to read files outside the intended directory. The low CVSS impact metrics (VC:L/VI:L/VA:L) suggest the endpoint likely exposes limited filesystem access, not arbitrary code execution.
Know when N3 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible, no auth, low impacts consistent with file read.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
More in N3 Firmware
View allUnauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Command injection in sgwbox N3 firmware 2.0.25 allows unauthenticated remote attackers to execute arbitrary operating sy
Command injection in the SHARESERVER component of sgwbox N3 NAS firmware 2.0.25 lets remote, unauthenticated attackers e
Remote buffer overflow in the sgwbox N3 NAS firmware (version 2.0.25) lets an unauthenticated network attacker corrupt m
Multiple ipTIME router models have a command injection vulnerability in the upnp_relay() function, allowing remote attac
Remote unauthenticated buffer overflow in the sgwbox (Shiguangwu) N3 firmware 2.0.25 lets network-reachable attackers co
Authentication bypass in the sgwbox N3 NAS appliance (firmware 2.0.25) allows a remote, unauthenticated attacker to reac
GitHub PoC
Exploit-DB