sgwbox N3 CVE-2025-14706
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed sgwbox N3 NAS
-
DeliverySend crafted request to NETREBOOT interface
-
ExploitInject shell command via http_eshell_server
-
ExecutionExecute arbitrary OS commands
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP service /usr/sbin/http_eshell_server and specifically its NETREBOOT interface endpoint; the attacker supplies crafted input that is passed unsanitized into an OS command. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no non-default configuration are stated as prerequisites, so any instance exposing this interface is attackable. The practical limiting factor is exposure of the management/NETREBOOT service to the attacker's network (LAN or internet) rather than any special device configuration; affected build is N3 firmware 2.0.25. |
| Impact | Signals are largely consistent and point to a genuine, exploitable issue rather than a paper-high CVSS. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) - appropriate for an OS command injection yielding code execution on a NAS appliance. Exploit code is publicly available (POC=YES) but the flaw is NOT in CISA KEV, so there is no confirmed active exploitation; the public POC should be treated as an elevated-but-unconfirmed exploitation signal, not weaponized in-the-wild use. EPSS is 18.62% (97th percentile) - low in absolute terms yet unusually high relative to the overall CVE population, consistent with a public POC against an internet-reachable device but short of mass exploitation. The limiting factor on real-world risk is deployment footprint, not technical difficulty: Shiguangwu/sgwbox is an obscure vendor, so widespread opportunistic exploitation is unlikely even though any exposed instance is trivially attackable. Note the vendor was contacted but did not respond, meaning there is no confirmed patch and affected-version boundaries rest solely on the single VulDB submission. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed sgwbox N3 NAS and sends a crafted request to the NETREBOOT interface handled by /usr/sbin/http_eshell_server, injecting shell metacharacters into a parameter that is passed to a system command. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the attacker gains arbitrary command execution on the device. A public proof-of-concept exists (published on Notion), lowering the skill needed to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Command injection in sgwbox N3 firmware 2.0.25 allows unauthenticated remote attackers to execute arbitrary operating system commands by sending crafted input to the NETREBOOT interface handled by /usr/sbin/http_eshell_server. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.9) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both confirm no authentication, no user interaction, and no special configuration are required, making any instance exposing this interface reachable directly attackable. Publicly available exploit code exists and EPSS is 18.62% (97th percentile), signaling elevated exploitation likelihood; the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, and the vendor did not respond to the disclosure, so remediation must rely on compensating controls. Immediately isolate sgwbox N3 devices on a dedicated management VLAN and block all inbound access to the HTTP management service (the port serving /usr/sbin/http_eshell_server and its NETREBOOT interface) from untrusted networks, especially the internet; explicitly firewall the NETREBOOT endpoint so only a small set of trusted administrative IPs can reach it. If remote reboot or HTTP shell management is not operationally required, disable the http_eshell_server service or the NETREBOOT functionality entirely - the trade-off is loss of remote management and the need for local or out-of-band administration. Where the service must stay enabled, enforce strict IP allowlisting, terminate management sessions to the same host, and monitor logs for POST requests to NETREBOOT paths containing shell metacharacters (;, |, &, backticks, $()) as an exploitation indicator. Given the vendor's silence and the presence of public exploit code, evaluate replacement of the device or additional network microsegmentation as the durable fix. Details and any updates should be tracked through the VulDB references at https://vuldb.com/?id.336423 and https://vuldb.com/?ctiid.336423.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected firmware ships a custom HTTP-based shell service, /usr/sbin/http_eshell_server, which exposes administrative functionality including a NETREBOOT interface endpoint. That endpoint passes attacker-controlled input into an OS command without proper neutralization, the classic command-injection pattern covered by CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., injection). Because the service runs on the device itself and is reachable over the network, successful exploitation yields command execution in the context of the HTTP server process, likely root or an equivalent privileged account on an embedded Linux platform. The CPE cpe:2.3:o:sgwbox:n3_firmware:* identifies the target as sgwbox N3 firmware, and the disclosure specifically validates version 2.0.25, though the wildcard CPE leaves open the possibility that other builds share the same code path. The CVSS 4.0 E:P metric corroborates the public proof-of-concept, while EPSS at the 97th percentile reflects high real-world interest despite the absence of a CISA KEV entry.
Know when N3 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remote unauthenticated command injection on a reachable HTTP interface (AV:N/AC:L/PR:N/UI:N) yields OS code execution, giving full C/I/A impact; scope unchanged within the single device.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the component NETREBOOT Interface. Such manipulation leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The sgwbox N3 firmware 2.0.25 contains a high-severity, unauthenticated remote command injection vulnerability in its NETREBOOT interface, allowing attackers to execute operating system commands on affected devices. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, so any exposed sgwbox N3 running version 2.0.25 is at immediate risk of compromise. Leadership should prioritize containment and isolation of these systems to prevent operational disruption and lateral movement.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or blocking the NETREBOOT interface and /usr/sbin/http_eshell_server, restricting management access to trusted networks, segmenting or isolating sgwbox N3 firmware 2.0.25 devices, applying IPS or WAF virtual patching signatures for command injection, and monitoring logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in N3 Firmware
View allUnauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Command injection in the SHARESERVER component of sgwbox N3 NAS firmware 2.0.25 lets remote, unauthenticated attackers e
Remote buffer overflow in the sgwbox N3 NAS firmware (version 2.0.25) lets an unauthenticated network attacker corrupt m
Multiple ipTIME router models have a command injection vulnerability in the upnp_relay() function, allowing remote attac
Remote unauthenticated buffer overflow in the sgwbox (Shiguangwu) N3 firmware 2.0.25 lets network-reachable attackers co
Authentication bypass in the sgwbox N3 NAS appliance (firmware 2.0.25) allows a remote, unauthenticated attacker to reac
Path traversal vulnerability in Shiguangwu sgwbox N3 NAS firmware 2.0.25 allows remote unauthenticated attackers to read
GitHub PoC
Exploit-DB