CVE-2025-14703

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-15

Last updated on: 2025-12-23

Assigner: VulDB

Description

A vulnerability has been found in Shiguangwu sgwbox N3 2.0.25. The affected element is an unknown function of the file /fsnotify of the component POST Message Handler. The manipulation of the argument token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-15

Last Modified

2025-12-23

Generated

2026-07-06

AI Q&A

2025-12-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-14703

EUVD

EUVD-2025-203325

Affected Vendors & Products

Vendor	Product	Version / Range
sgwbox	n3_nas	to 2.0.25 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-NVD-CWE-noinfo
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Impact Analysis

This vulnerability can allow an attacker to remotely bypass authentication and gain unauthorized access to the NAS device. This can lead to unauthorized disclosure of sensitive internal information and manipulation of the device to execute arbitrary commands, potentially compromising the confidentiality and integrity of your data and systems. [1, 2]

Compliance Impact

The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

There are no known mitigations or patches available for this vulnerability. It is suggested to consider replacing the affected product with an alternative to mitigate the risk. Since the vendor did not respond or provide any countermeasures, immediate mitigation involves discontinuing use of the vulnerable Shiguangwu sgwbox N3 version 2.0.25 device or isolating it from untrusted networks to prevent remote exploitation. [2]

Executive Summary

CVE-2025-14703 is an authentication bypass vulnerability in Shiguangwu sgwbox N3 version 2.0.25. It occurs because the system fails to properly verify the 'token' argument in the POST message handler at the /fsnotify endpoint. This improper authentication allows an attacker to remotely bypass authentication controls without authorization, potentially disclosing internal NAS information and manipulating the device to execute commands. [1, 2]

Hi! I’m here to help you understand CVE-2025-14703. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70