SGWBox N3 CVE-2025-14709
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device HTTP service over network
-
DeliverySend crafted WIRELESSCFGGET request
-
ExploitOverflow buffer via oversized 'params'
-
ExecutionCorrupt memory in http_eshell_server
-
PersistExecute arbitrary code / crash service
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the device's embedded HTTP service (http_eshell_server) and the ability to reach the WIRELESSCFGGET interface, then supplying a malicious 'params' argument that overflows a fixed-size buffer. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed, so it works against reachable default deployments; the practical limiting factor is exposure - the device/management interface must be network-reachable to the attacker (e.g., LAN or an Internet-exposed management port), and the device must be running the affected sgwbox N3 2.0.25 firmware. |
| Impact | Multiple signals align toward genuine technical severity but limited real-world urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 8.9) describes a network-reachable, low-complexity, unauthenticated flaw with full compromise of confidentiality, integrity, and availability - consistent with a remotely triggerable buffer overflow (CWE-119) in a network service. The vector's E:P (Proof-of-Concept) and the reported publicly available exploit on Notion confirm working exploit code exists, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The reporting source is VulDB/cna@vuldb.com rather than the vendor, and the vendor was contacted but did not respond, meaning no official patch or confirmed fixed version exists. Net assessment: technically high-impact and exploitable, but the obscure, low-footprint target (a Shiguangwu sgwbox N3 NAS) makes this a targeted-opportunity issue rather than a mass-exploitation priority. Treat as high priority for anyone actually running this device, lower priority in the broad fleet. Note the gap: active-exploitation status is unknown (no KEV, no EPSS) despite a public PoC - do not conflate PoC availability with in-the-wild use. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network access to the device's HTTP service sends a crafted request to the WIRELESSCFGGET interface of http_eshell_server with an oversized or malformed 'params' argument, overflowing a buffer. Because low-complexity remote exploitation is possible and public exploit code has been disclosed, an attacker can leverage it to crash the service or achieve arbitrary code execution on the NAS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Remote unauthenticated buffer overflow in the sgwbox (Shiguangwu) N3 firmware 2.0.25 lets network-reachable attackers corrupt memory in the embedded /usr/sbin/http_eshell_server service by supplying an oversized 'params' argument to its WIRELESSCFGGET interface, yielding high confidentiality, integrity, and availability impact for the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Publicly available exploit code exists and the vendor was contacted but never responded, so no fixed firmware has been identified; there is no CISA KEV confirmation of active exploitation, meaning real-world urgency is currently limited by exposure rather than by technical severity. The practical gate is reachability: the device's embedded HTTP management service must be accessible from the attacker's network position, such as a shared LAN or an Internet-exposed management port.
RemediationAI
No vendor-released patch has been identified at time of analysis: the vendor was contacted early about this disclosure and did not respond, and no fixed firmware version appears in any reference, so the only available remediations are compensating controls. Because exploitation requires network access to the WIRELESSCFGGET interface of http_eshell_server, the highest-value control is to remove that reachability - block inbound access to the device's embedded HTTP management port at the network perimeter and on the host firewall, and never port-forward it to the Internet; the trade-off is loss of remote/cloud management and any app-based configuration until a fixed firmware exists. Second, isolate the N3 device on a dedicated, restricted VLAN with no trust relationships to user workstations or servers, accepting that a compromised device then cannot be used to pivot into the wider network but remains locally exploitable by anyone on that segment. Third, where the firmware permits it, disable remote administration and the wireless-configuration/WIRELESSCFGGET functionality and change default credentials, noting that these measures reduce but do not eliminate the overflow path since the flaw is pre-authentication. Monitor the vendor and the VulDB entries (https://vuldb.com/?id.336426) for a firmware update; given the absence of vendor engagement and the existence of public exploit code, treat the device as end-of-secure-life and plan replacement if no patch materializes. There is no KEV-confirmed active exploitation at time of analysis, so these steps are precautionary rather than incident-driven.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-119, improper restriction of operations within the bounds of a memory buffer - the class-level weakness that encompasses classic stack and heap overflows. The vulnerable component is the firmware binary /usr/sbin/http_eshell_server, an embedded HTTP service that exposes a WIRELESSCFGGET interface used to read or set wireless configuration parameters. The 'params' argument supplied over that interface is copied into a fixed-size buffer without adequate length validation, so an oversized value overwrites adjacent memory and can redirect control flow or corrupt state within the service process. The CPE record cpe:2.3:o:sgwbox:n3_firmware:*:*:*:*:*:*:*:* anchors the flaw to the N3 firmware image rather than to a separately installable application, which is typical of consumer/SOHO router and NAS-class devices: the daemon runs with elevated privileges on the device's network stack, so a pre-authentication overflow (PR:N, UI:N, AV:N per the assessed vector) can translate directly into full device compromise without any scope change (S:U with C:H/I:H/A:H). Network-facing embedded HTTP daemons of this type are commonly reachable on the LAN and, in misconfigured deployments, from the WAN.
Know when N3 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remote unauthenticated buffer overflow in a network service with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding memory-corruption RCE, so C/I/A all High.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in Shiguangwu sgwbox N3 2.0.25. Affected by this issue is some unknown functionality of the file /usr/sbin/http_eshell_server of the component WIRELESSCFGGET Interface. The manipulation of the argument params leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
sgwbox (Shiguangwu) N3 firmware 2.0.25 carries a high-severity remote unauthenticated memory-corruption flaw in its embedded management service, and publicly available exploit code exists. If that management interface is reachable from shared or untrusted networks, an attacker could compromise the device and the data or network access it mediates, making exposure the primary business risk. No vendor-released patch identified at time of analysis, so leadership should prioritize inventory, network isolation, and access restriction for exposed N3 devices until fixed firmware is available and validated.
No vendor-released patch identified at time of analysis; isolate sgwbox N3 2.0.25 devices on a dedicated VLAN, block or disable the http_eshell_server management service from untrusted networks, restrict administrative access to a VPN or jump host with allowlisted IPs, deploy IPS/WAF signatures to reject oversized 'params' arguments to WIRELESSCFGGET, enable logging and alerting for crashes, configuration changes, and anomalous requests, and plan replacement or retirement for Internet- or shared-LAN-exposed units until fixed firmware is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in N3 Firmware
View allUnauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Command injection in sgwbox N3 firmware 2.0.25 allows unauthenticated remote attackers to execute arbitrary operating sy
Command injection in the SHARESERVER component of sgwbox N3 NAS firmware 2.0.25 lets remote, unauthenticated attackers e
Remote buffer overflow in the sgwbox N3 NAS firmware (version 2.0.25) lets an unauthenticated network attacker corrupt m
Multiple ipTIME router models have a command injection vulnerability in the upnp_relay() function, allowing remote attac
Authentication bypass in the sgwbox N3 NAS appliance (firmware 2.0.25) allows a remote, unauthenticated attacker to reac
Path traversal vulnerability in Shiguangwu sgwbox N3 NAS firmware 2.0.25 allows remote unauthenticated attackers to read
GitHub PoC
Exploit-DB