Vulnerability details

CVE-2025-14705

Shiguangwu sgwbox N3

Shiguangwu sgwbox N3 SHARESERVER Feature command injection

CVSS 4.0

9.3Critical

Official description

A vulnerability was determined in Shiguangwu sgwbox N3 2.0.25. This affects an unknown function of the component SHARESERVER Feature. This manipulation of the argument params causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS scores

Score	Version	Source	Vector
9.3Critical	4.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P`
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R`
9.8Critical	3.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R`
10.0High	2.0	CVEProject cvelistV5 (CNA) (VulDB)	`AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR`

Affected products

Vendor	Product	Versions	Source
Shiguangwu	sgwbox N3	2.0.25	CVEProject cvelistV5 (CNA)

References and advisories

https://vuldb.com/?id.336422 vdb-entrytechnical-description
https://vuldb.com/?ctiid.336422 signaturepermissions-required
https://vuldb.com/?submit.706974 third-party-advisory
https://www.notion.so/sgwbox-NAS-N3-Command-Injection-2be6cf4e528a80d69da5d6d17456a183?source=copy_link exploit

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-12-15
Last updated: 2025-12-15
State: Published
Assigner (CNA): VulDB

Exploit prediction (EPSS)

16.5%

Probability of exploitation in 30 days

96.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-77
Command Injection
CWE-74
Injection