CVE-2025-14707

CRITICAL

sgwbox N3 Firmware < 2.0.25 - Remote Command Injection via http_eshell_server params Argument

Title source: llm
STIX 2.1

Description

A security flaw has been discovered in Shiguangwu sgwbox N3 2.0.25. Affected is an unknown function of the file /usr/sbin/http_eshell_server of the component DOCKER Feature. Performing manipulation of the argument params results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.336424
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.336424
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.706976

Scores

CVSS v3 9.8
EPSS 0.1649
EPSS Percentile 96.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-74 CWE-77
Status published
Products (1)
sgwbox/n3_firmware < 2.0.25
Published Dec 15, 2025
Tracked Since Feb 18, 2026