Cyber Posture

CVE-2025-14706

CriticalPublic PoC

Published: 15 December 2025

Published
15 December 2025
Modified
31 December 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0147 81.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the component NETREBOOT Interface. Such manipulation leads to command injection. The attack can be launched remotely. The exploit is publicly available…

more

and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection in /usr/sbin/http_eshell_server by requiring validation and sanitization of all inputs to block malicious command insertion.

SI-2 Flaw Remediation good match
preventrecover

Mitigates the specific CVE-2025-14706 flaw through timely identification, patching, or workarounds despite lack of vendor response, including post-remediation verification.

AC-6 Least Privilege partial match
prevent

Reduces impact of successful remote command injection by enforcing least privilege on the NETREBOOT interface processes, limiting executable commands.

Security SummaryAI

CVE-2025-14706 is a command injection vulnerability in Shiguangwu sgwbox N3 version 2.0.25. It affects an unknown function in the file /usr/sbin/http_eshell_server within the NETREBOOT Interface component. Published on 2025-12-15, the flaw is associated with CWEs CWE-74 and CWE-77 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerability enables remote exploitation without user interaction or privileges. Attackers can manipulate the affected component to inject commands, potentially compromising confidentiality, integrity, and availability with high impact.

Disclosure references from VulDB indicate the vendor was contacted early but provided no response, implying no official patches or mitigations are available. The exploit is publicly available and might be used; relevant details appear in VulDB entries (ctiid.336423, id.336423, submit.706975) and a Notion page on the sgwbox NAS N3 command injection.

Details

CWE(s)
CWE-74CWE-77

Affected Products

sgwbox
n3 firmware
≤ 2.0.25

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Unauthenticated remote command injection in /usr/sbin/http_eshell_server (NETREBOOT Interface) enables exploitation of public-facing applications (T1190), exploitation of remote services (T1210), indirect command execution (T1202 as cited in advisory), and Unix Shell command execution (T1059.004).

References