CVE-2025-14703
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-23
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sgwbox | n3_nas | to 2.0.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can allow an attacker to remotely bypass authentication and gain unauthorized access to the NAS device. This can lead to unauthorized disclosure of sensitive internal information and manipulation of the device to execute arbitrary commands, potentially compromising the confidentiality and integrity of your data and systems. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
There are no known mitigations or patches available for this vulnerability. It is suggested to consider replacing the affected product with an alternative to mitigate the risk. Since the vendor did not respond or provide any countermeasures, immediate mitigation involves discontinuing use of the vulnerable Shiguangwu sgwbox N3 version 2.0.25 device or isolating it from untrusted networks to prevent remote exploitation. [2]
Can you explain this vulnerability to me?
CVE-2025-14703 is an authentication bypass vulnerability in Shiguangwu sgwbox N3 version 2.0.25. It occurs because the system fails to properly verify the 'token' argument in the POST message handler at the /fsnotify endpoint. This improper authentication allows an attacker to remotely bypass authentication controls without authorization, potentially disclosing internal NAS information and manipulating the device to execute commands. [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.