Cyber Posture

CVE-2025-14704

HighPublic PoC

Published: 15 December 2025

Published
15 December 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0042 62.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit…

more

has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates path traversal vulnerability by requiring validation of API inputs in /eshell to reject malicious path sequences like '../'.

preventdetect

Boundary protection at external interfaces protects the publicly accessible API endpoint from remote unauthenticated path traversal attacks via inspection and filtering.

prevent

Least privilege limits the file system access of the vulnerable API component, reducing the impact of successful directory traversal exploitation.

Security SummaryAI

CVE-2025-14704 is a path traversal vulnerability (CWE-22) in Shiguangwu sgwbox N3 version 2.0.25. The issue affects an unknown function in the /eshell file of the API component, allowing manipulation that enables directory traversal attacks.

The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), meaning it can be exploited remotely by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation results in low-level impacts on confidentiality, integrity, and availability, such as unauthorized file access, modification, or disruption via path traversal.

Advisories from VulDB indicate the vendor was contacted early about the disclosure but provided no response, and no patches or mitigations are referenced. The exploit has been made public, increasing the risk of active use. Additional details appear in VulDB entries (ctiid.336421, id.336421, submit.706915) and a Notion page on sgwbox NAS N3 directory traversal. The CVE was published on 2025-12-15.

Details

CWE(s)

Affected Products

sgwbox
n3 firmware
≤ 2.0.25

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1006 Direct Volume Access Stealth
Adversaries may directly access a volume to bypass file access controls and file system monitoring.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Path traversal in unauthenticated public-facing API (/eshell) enables exploitation of public-facing application (T1190), arbitrary file reads for data from local system (T1005), and direct volume access bypassing restrictions (T1006) as mapped by advisory; also facilitates arbitrary writes.

References