N3 Firmware
Monthly
Multiple ipTIME router models have a command injection vulnerability in the upnp_relay() function, allowing remote attackers to execute arbitrary OS commands through crafted UPnP requests.
Remote unauthenticated buffer overflow in the sgwbox (Shiguangwu) N3 firmware 2.0.25 lets network-reachable attackers corrupt memory in the embedded /usr/sbin/http_eshell_server service by supplying an oversized 'params' argument to its WIRELESSCFGGET interface, yielding high confidentiality, integrity, and availability impact for the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Publicly available exploit code exists and the vendor was contacted but never responded, so no fixed firmware has been identified; there is no CISA KEV confirmation of active exploitation, meaning real-world urgency is currently limited by exposure rather than by technical severity. The practical gate is reachability: the device's embedded HTTP management service must be accessible from the attacker's network position, such as a shared LAN or an Internet-exposed management port.
Remote buffer overflow in the sgwbox N3 NAS firmware (version 2.0.25) lets an unauthenticated network attacker corrupt memory through the WIREDCFGGET interface handled by /usr/sbin/http_eshell_server, with high impact on confidentiality, integrity and availability (assessed CVSS:3.1 8.8/9.8-class, AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists - a Notion write-up detailing the overflow was published alongside the disclosure - but there is no evidence of confirmed active exploitation (no CISA KEV listing). Practical risk is constrained less by technical difficulty than by exposure: these NAS units normally sit behind LAN/NAT boundaries and have a very small installed base, and no vendor patch exists because the vendor did not respond to the disclosure.
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system commands on the device by manipulating the 'params' argument handled by /usr/sbin/http_eshell_server, which backs the product's DOCKER feature. The vendor was contacted about the flaw but did not respond, and publicly available exploit code exists, including a public write-up; EPSS is 18.62% (97th percentile), so exploitation risk is elevated for any unit whose management/Docker HTTP interface is network-reachable. Impact is high across confidentiality, integrity and availability, though real-world exposure is limited by the small deployment base of this product and by whether the interface is internet- or LAN-reachable.
Command injection in sgwbox N3 firmware 2.0.25 allows unauthenticated remote attackers to execute arbitrary operating system commands by sending crafted input to the NETREBOOT interface handled by /usr/sbin/http_eshell_server. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.9) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both confirm no authentication, no user interaction, and no special configuration are required, making any instance exposing this interface reachable directly attackable. Publicly available exploit code exists and EPSS is 18.62% (97th percentile), signaling elevated exploitation likelihood; the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis.
Command injection in the SHARESERVER component of sgwbox N3 NAS firmware 2.0.25 lets remote, unauthenticated attackers execute operating-system commands on the device by manipulating the 'params' argument, yielding high impact to confidentiality, integrity, and availability. Publicly available exploit code exists (a proof-of-concept write-up is linked in the references), and EPSS rates the likelihood of exploitation at roughly 16.5% (97th percentile), though the vulnerability is not confirmed actively exploited (not in CISA KEV). The vendor was contacted about the disclosure and did not respond, and no vendor-released patch has been identified, so exposure is governed almost entirely by whether the SHARESERVER interface is reachable from untrusted networks.
Path traversal vulnerability in Shiguangwu sgwbox N3 NAS firmware 2.0.25 allows remote unauthenticated attackers to read arbitrary files via the /eshell API endpoint. A public exploit is available, and no vendor patch exists yet. EPSS score of 0.42% indicates moderate exploitation probability, though no active exploitation is currently confirmed (no CISA KEV listing).
Authentication bypass in the sgwbox N3 NAS appliance (firmware 2.0.25) allows a remote, unauthenticated attacker to reach the /fsnotify endpoint of the POST Message Handler and manipulate the 'token' argument so that requests are accepted without valid credentials, resulting in low-impact confidentiality exposure. Publicly available exploit code exists in the form of a published Notion write-up, and the vendor was contacted but never responded, so no vendor-released patch has been identified at time of analysis. EPSS is 0.68% (51st percentile) and the issue is not confirmed actively exploited (no CISA KEV listing); the practical risk is driven by whether the appliance's web management interface is reachable, since sgwbox N3 is a niche product with a very small installed base.
Multiple ipTIME router models have a command injection vulnerability in the upnp_relay() function, allowing remote attackers to execute arbitrary OS commands through crafted UPnP requests.
Remote unauthenticated buffer overflow in the sgwbox (Shiguangwu) N3 firmware 2.0.25 lets network-reachable attackers corrupt memory in the embedded /usr/sbin/http_eshell_server service by supplying an oversized 'params' argument to its WIRELESSCFGGET interface, yielding high confidentiality, integrity, and availability impact for the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Publicly available exploit code exists and the vendor was contacted but never responded, so no fixed firmware has been identified; there is no CISA KEV confirmation of active exploitation, meaning real-world urgency is currently limited by exposure rather than by technical severity. The practical gate is reachability: the device's embedded HTTP management service must be accessible from the attacker's network position, such as a shared LAN or an Internet-exposed management port.
Remote buffer overflow in the sgwbox N3 NAS firmware (version 2.0.25) lets an unauthenticated network attacker corrupt memory through the WIREDCFGGET interface handled by /usr/sbin/http_eshell_server, with high impact on confidentiality, integrity and availability (assessed CVSS:3.1 8.8/9.8-class, AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists - a Notion write-up detailing the overflow was published alongside the disclosure - but there is no evidence of confirmed active exploitation (no CISA KEV listing). Practical risk is constrained less by technical difficulty than by exposure: these NAS units normally sit behind LAN/NAT boundaries and have a very small installed base, and no vendor patch exists because the vendor did not respond to the disclosure.
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system commands on the device by manipulating the 'params' argument handled by /usr/sbin/http_eshell_server, which backs the product's DOCKER feature. The vendor was contacted about the flaw but did not respond, and publicly available exploit code exists, including a public write-up; EPSS is 18.62% (97th percentile), so exploitation risk is elevated for any unit whose management/Docker HTTP interface is network-reachable. Impact is high across confidentiality, integrity and availability, though real-world exposure is limited by the small deployment base of this product and by whether the interface is internet- or LAN-reachable.
Command injection in sgwbox N3 firmware 2.0.25 allows unauthenticated remote attackers to execute arbitrary operating system commands by sending crafted input to the NETREBOOT interface handled by /usr/sbin/http_eshell_server. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.9) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both confirm no authentication, no user interaction, and no special configuration are required, making any instance exposing this interface reachable directly attackable. Publicly available exploit code exists and EPSS is 18.62% (97th percentile), signaling elevated exploitation likelihood; the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis.
Command injection in the SHARESERVER component of sgwbox N3 NAS firmware 2.0.25 lets remote, unauthenticated attackers execute operating-system commands on the device by manipulating the 'params' argument, yielding high impact to confidentiality, integrity, and availability. Publicly available exploit code exists (a proof-of-concept write-up is linked in the references), and EPSS rates the likelihood of exploitation at roughly 16.5% (97th percentile), though the vulnerability is not confirmed actively exploited (not in CISA KEV). The vendor was contacted about the disclosure and did not respond, and no vendor-released patch has been identified, so exposure is governed almost entirely by whether the SHARESERVER interface is reachable from untrusted networks.
Path traversal vulnerability in Shiguangwu sgwbox N3 NAS firmware 2.0.25 allows remote unauthenticated attackers to read arbitrary files via the /eshell API endpoint. A public exploit is available, and no vendor patch exists yet. EPSS score of 0.42% indicates moderate exploitation probability, though no active exploitation is currently confirmed (no CISA KEV listing).
Authentication bypass in the sgwbox N3 NAS appliance (firmware 2.0.25) allows a remote, unauthenticated attacker to reach the /fsnotify endpoint of the POST Message Handler and manipulate the 'token' argument so that requests are accepted without valid credentials, resulting in low-impact confidentiality exposure. Publicly available exploit code exists in the form of a published Notion write-up, and the vendor was contacted but never responded, so no vendor-released patch has been identified at time of analysis. EPSS is 0.68% (51st percentile) and the issue is not confirmed actively exploited (no CISA KEV listing); the practical risk is driven by whether the appliance's web management interface is reachable, since sgwbox N3 is a niche product with a very small installed base.