SGWBOX N3 CVE-2025-14707
HIGHSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated command injection with no user interaction (AV:N/AC:L/PR:N/UI:N); OS command execution yields full C/I/A on the device with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Shiguangwu sgwbox N3 2.0.25. Affected is an unknown function of the file /usr/sbin/http_eshell_server of the component DOCKER Feature. Performing manipulation of the argument params results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system commands on the device by manipulating the 'params' argument handled by /usr/sbin/http_eshell_server, which backs the product's DOCKER feature. The vendor was contacted about the flaw but did not respond, and publicly available exploit code exists, including a public write-up; EPSS is 18.62% (97th percentile), so exploitation risk is elevated for any unit whose management/Docker HTTP interface is network-reachable. Impact is high across confidentiality, integrity and availability, though real-world exposure is limited by the small deployment base of this product and by whether the interface is internet- or LAN-reachable.
Technical ContextAI
The vulnerability is an injection flaw of class CWE-74 (improper neutralization of special elements that are later interpreted by a downstream component) - effectively OS command injection - in the SGWBOX N3 firmware's DOCKER feature. The affected binary, /usr/sbin/http_eshell_server, appears to expose an HTTP endpoint that accepts a 'params' argument and passes it into a shell command context without adequate escaping or allow-listing, so shell metacharacters in the supplied value are interpreted by the underlying command interpreter and let the caller run arbitrary commands with the privileges of that service. The CPE entry cpe:2.3:o:sgwbox:n3_firmware:*:*:*:*:*:*:*:* indicates the flaw is in the device firmware rather than in a separately packaged application, and the referenced VulDB records and public Notion write-up confirm the issue is reachable over the network. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication, no user interaction and no non-default preconditions, so a default-configuration device with the service exposed is remotely exploitable; the only practical limiting factor is network reachability of the management/Docker interface.
RemediationAI
No vendor-released patch identified at time of analysis: the vendor was contacted early but did not respond, and no fix version exists in the available data, so remediation must rely on compensating controls. The most effective control is to remove network reachability of the affected service - block external access to the management/Docker HTTP interface at the firewall, keep the device on an isolated management VLAN or behind a VPN/jump host, and never expose it directly to the internet; the trade-off is loss of remote or cloud-based administration convenience. If the DOCKER feature and /usr/sbin/http_eshell_server are not required, disable the DOCKER feature and stop or mask the http_eshell_server service, accepting that the vendor's web management functionality may stop working. Where the service must remain reachable, restrict access by source IP allow-list, enforce strong authentication on any fronting reverse proxy, and monitor logs for requests to the endpoint carrying shell metacharacters such as semicolons, backticks, pipes, or $() as signs of attempted exploitation. Given the publicly available exploit code and the elevated EPSS score, units that cannot be patched, isolated, or have the service disabled should be considered for decommissioning or replacement, since the absence of a vendor fix leaves no fully reliable software remediation at this time.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today