CVE-2025-14706
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-23
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sgwbox | n3_nas | to 2.0.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2025-14706 is a critical command injection vulnerability in the Shiguangwu sgwbox N3 version 2.0.25. It exists in the NETREBOOT interface accessed via the /usr/sbin/http_eshell_server file. Due to improper filtering of input, an unauthenticated attacker can send a specially crafted POST request to this interface and remotely execute arbitrary commands with root privileges on the device. This allows the attacker to gain full control over the affected NAS system. [1, 2]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized remote command execution with root privileges, leading to full compromise of the affected system. It affects the confidentiality, integrity, and availability of the device, allowing attackers to control, manipulate, or disrupt the NAS device remotely without any authentication. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or patches exist for this vulnerability. The vendor did not respond to the disclosure. The suggested mitigation is to replace the affected product to avoid exploitation. [2]