Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-14705: Shiguangwu sgwbox N3 2.0.25: Remote Command Injection Risk

CVE-2025-14705 · published 10 months ago

Summary

The SHARESERVER Feature in Shiguangwu sgwbox N3 2.0.25 is open to a security risk where an attacker can send malicious input to execute unauthorized commands remotely. This means a hacker could potentially take control of your system. We recommend updating to a fixed version of the software as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
sgwbox	n3_firmware	<= 2.0.25 `cpe:2.3:o:sgwbox:n3_firmware::::::::`

Original advisory text

A vulnerability was determined in Shiguangwu sgwbox N3 2.0.25. This affects an unknown function of the component SHARESERVER Feature. This manipulation of the argument params causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://vuldb.com/?ctiid.336422 Permissions Required VDB Entry
https://vuldb.com/?id.336422 Third Party Advisory VDB Entry
https://vuldb.com/?submit.706974 Third Party Advisory VDB Entry
https://www.notion.so/sgwbox-NAS-N3-Command-Injection-2be6cf4e528a80d69da5d6d174... Exploit Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

8.9 High

Exploitation

17% chance of attack within 30 days

Type

CWE-74Injection

CWE-77Command Injection

Timeline

Published15 Dec 2025

Updated3 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-14705 · NVD

Track software like this

Free during beta