CVE-2025-14704
BaseFortify
Publication date: 2025-12-15
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sgwbox | n3_nas | to 2.0.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-14704 is a critical path traversal vulnerability in Shiguangwu sgwbox N3 version 2.0.25, specifically in an unknown function of the API component at the /eshell endpoint. It allows attackers to manipulate file paths to access directories and files outside the intended restricted area. This can be done remotely without authentication, making it easy for attackers to exploit. The vulnerability enables unauthorized reading and writing of arbitrary files on the device, compromising system security. [1, 2]
How can this vulnerability impact me? :
This vulnerability can severely impact you by allowing attackers to remotely access and retrieve any files from the affected NAS device, including sensitive system and user files. Attackers can also perform arbitrary write operations, potentially modifying or deleting critical files. This compromises the confidentiality, integrity, and availability of your system, leading to data breaches, system corruption, or denial of service. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
No known mitigations currently exist for this vulnerability. It is suggested to consider replacing the affected product, Shiguangwu sgwbox N3 version 2.0.25, as the vendor has not provided any countermeasures or patches. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized remote attackers to access and retrieve arbitrary files, including potentially sensitive user and system data, due to path traversal flaws. Such unauthorized access and potential data exposure can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding confidentiality and integrity of personal and health information. The lack of vendor response and absence of mitigations increase the risk of non-compliance with these standards. [1, 2]