sgwbox N3 CVE-2025-14705

Exploitation requires the sgwbox N3 NAS SHARESERVER feature/service to be reachable by the attacker; the injection is triggered by manipulating the 'params' argument handled by that component. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) this is remote, unauthenticated exploitation needing no user interaction and no special attack requirements against the affected firmware. The primary limiting factor is network exposure: devices behind NAT or not exposing the SHARESERVER interface to untrusted networks are not remotely reachable, which - combined with the product's niche deployment - constrains realistic mass exploitation. No official patch is available since the vendor did not respond.

Signals are largely consistent and point to a genuine remote-code-execution-class issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes an unauthenticated, network-reachable command injection requiring no user interaction and no special attack prerequisites - the highest-exposure profile. EPSS reinforces concern: 16.50% is a moderately high probability in absolute terms and sits in the 97th percentile, indicating this CVE is among the more likely-to-be-exploited issues currently tracked, which aligns with the publicly available exploit code. The one mitigating counter-signal is deployment footprint: the affected product (sgwbox N3 NAS firmware) is from an obscure vendor, so absolute real-world risk is bounded by its limited installed base rather than by exploitability. This is NOT a high-CVSS-but-low-real-risk case technically - exploitation is trivial where the device is exposed - but it is more likely to see targeted/opportunistic internet-wide scanning against a niche appliance than a widespread enterprise event. Note the vendor did not respond to disclosure, so no official patch is confirmed; defenders should treat affected devices as unpatched. It is NOT in CISA KEV, so there is no confirmed active exploitation despite the high EPSS and public POC.

A remote, unauthenticated attacker locates an internet-exposed sgwbox N3 NAS and sends a crafted request to the SHARESERVER feature, injecting shell metacharacters into the vulnerable 'params' argument. Because a public exploit write-up exists (hosted on Notion and referenced via VulDB), the injected commands execute on the device with the service's privileges, yielding arbitrary command execution and full compromise of confidentiality, integrity, and availability. No authentication or user interaction is required.