sgwbox N3 NAS CVE-2025-14708
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device HTTP management service
-
DeliverySend crafted WIREDCFGGET request
-
ExploitOverflow buffer via params argument
-
ExecutionCorrupt memory in http_eshell_server
-
ImpactCrash service or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the sgwbox N3's embedded management HTTP service (/usr/sbin/http_eshell_server) and the ability to invoke its WIREDCFGGET interface with attacker-controlled 'params'. No authentication, user interaction, or special configuration is indicated (AV:N/AC:L/PR:N/UI:N), so default-exposed management interfaces are directly at risk. Realistic exploitation is limited chiefly by network exposure - these NAS devices are typically behind a LAN/NAT and rarely internet-facing - and by the very small installed base; no vendor patch exists, so exposure cannot be remediated by update. |
| Impact | Signals conflict on real-world priority. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, full VC:H/VI:H/VA:H) describes an ideal unauthenticated remote memory-corruption RCE, and the input confirms POC/exploit code is publicly available (E:P in the vector, plus a Notion exploit reference), which raises exploitability above a purely theoretical flaw. However, the counterweight is strong: this is a VulDB-originated disclosure (cna@vuldb.com) for an obscure Chinese NAS appliance, the vendor never responded and no patch exists, and VulDB-style 'buffer overflow' entries frequently prove out only as denial-of-service crashes rather than confirmed arbitrary-code-execution - the description states only 'buffer overflow' and gives no evidence of achieved code execution. No EPSS score and no CISA KEV listing are present in the input, so there is no signal of widespread or active exploitation; exploitation status is therefore 'publicly available exploit code exists' and must NOT be conflated with active exploitation. Net: genuinely dangerous to the small population that runs this device (unauthenticated, remote, public POC, unpatched), but low aggregate risk due to rare deployment and unproven code-execution impact. Verify the actual impact (RCE vs. DoS) against the public POC before treating the full-CIA CVSS as confirmed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the device's embedded HTTP management service sends a crafted request to the WIREDCFGGET interface of /usr/sbin/http_eshell_server with an oversized or malformed 'params' argument, overflowing a buffer. Public exploit code exists (a Notion writeup), lowering the skill barrier; the immediate observable effect is service crash/DoS, with potential arbitrary code execution on the NAS given the embedded-shell HTTP server context. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Remote buffer overflow in the sgwbox N3 NAS firmware (version 2.0.25) lets an unauthenticated network attacker corrupt memory through the WIREDCFGGET interface handled by /usr/sbin/http_eshell_server, with high impact on confidentiality, integrity and availability (assessed CVSS:3.1 8.8/9.8-class, AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists - a Notion write-up detailing the overflow was published alongside the disclosure - but there is no evidence of confirmed active exploitation (no CISA KEV listing). Practical risk is constrained less by technical difficulty than by exposure: these NAS units normally sit behind LAN/NAT boundaries and have a very small installed base, and no vendor patch exists because the vendor did not respond to the disclosure.
RemediationAI
No vendor-released patch identified at time of analysis - Shiguangwu was contacted prior to publication and did not respond, and the wildcard CPE confirms no fixed firmware version. Because the defect cannot be updated away, compensating controls are the only mitigation: immediately remove any sgwbox N3 management interface from internet exposure and block inbound access to the device's HTTP management port at the perimeter firewall/router (trade-off: remote administration must then be performed from the LAN or via a VPN/tunnel); place the NAS on an isolated VLAN with no routing to sensitive segments and restrict WIREDCFGGET traffic to explicitly trusted admin hosts via ACLs (trade-off: legitimate management clients must be re-allowed individually); if the device must be reachable, front it with a reverse proxy or WAF rule that caps request-body/parameter length and rejects oversized 'params' values (trade-off: imperfect, since a WAF cannot fully model the binary's parsing, and binary-specific bypasses may exist); monitor the http_eshell_server process for crashes or abnormal restarts as an exploitation indicator, and plan device replacement or retirement given the vendor's non-response and the loss of any future firmware support.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic memory-safety defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in the embedded HTTP management service /usr/sbin/http_eshell_server shipped with sgwbox N3 NAS firmware. Specifically, the WIREDCFGGET interface accepts an attacker-controlled 'params' argument and processes it without adequate length validation, so oversized input overwrites adjacent memory and can lead to code execution or service crash in the context of the HTTP server process. The CPE entry cpe:2.3:o:sgwbox:n3_firmware:* uses a wildcard version, indicating the vendor does not enumerate fixed revisions - consistent with the absence of a patch. Root cause is missing bounds checking on a network-facing configuration getter, a pattern common in lightweight IoT/NAS management daemons that are rarely fuzzed or hardened.
Know when N3 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Unauthenticated remote reachable interface gives AV:N/AC:L/PR:N/UI:N; full CIA reflects the optimistic embedded-RCE reading, though only DoS (A:H) is firmly evidenced and C:H/I:H are plausible-but-unconfirmed.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in Shiguangwu sgwbox N3 2.0.25. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/http_eshell_server of the component WIREDCFGGET Interface. Executing manipulation of the argument params can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A high-severity buffer overflow in sgwbox N3 NAS firmware version 2.0.25 allows an unauthenticated network attacker to corrupt memory through the WIREDCFGGET interface, putting stored data and device availability at risk. Publicly available exploit code exists and No vendor-released patch identified at time of analysis, so any organization using these NAS units should treat them as unsafe for exposure to untrusted networks. Leadership should care because these appliances may hold sensitive files or backups, and a compromised device could provide a foothold for broader network compromise.
No vendor-released patch identified at time of analysis. Isolate sgwbox N3 NAS firmware 2.0.25 on a dedicated VLAN, block WAN access, restrict WIREDCFGGET/web management to trusted administrators, disable remote management and unused services, apply virtual patching/IDS signatures for CVE-2025-14708, and replace or retire the device if isolation cannot be guaranteed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in N3 Firmware
View allUnauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Command injection in sgwbox N3 firmware 2.0.25 allows unauthenticated remote attackers to execute arbitrary operating sy
Command injection in the SHARESERVER component of sgwbox N3 NAS firmware 2.0.25 lets remote, unauthenticated attackers e
Multiple ipTIME router models have a command injection vulnerability in the upnp_relay() function, allowing remote attac
Remote unauthenticated buffer overflow in the sgwbox (Shiguangwu) N3 firmware 2.0.25 lets network-reachable attackers co
Authentication bypass in the sgwbox N3 NAS appliance (firmware 2.0.25) allows a remote, unauthenticated attacker to reac
Path traversal vulnerability in Shiguangwu sgwbox N3 NAS firmware 2.0.25 allows remote unauthenticated attackers to read
GitHub PoC
Exploit-DB