CVE-2025-14704

medium · 5.5

A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

5.5

CVSS

12.5%

EPSS (exploit prob.)

96th

EPSS percentile

2025-12-15

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
sgwbox	n3_firmware	<= 2.0.25
sgwbox	n3	all versions

Check a specific version with /api/v1/cve/match.

References

https://vuldb.com/?ctiid.336421
https://vuldb.com/?id.336421
https://vuldb.com/?submit.706915
https://www.notion.so/sgwbox-NAS-N3-Directory-Traversal-2be6cf4e528a802a9c0ad6f01b75694e?source=copy_link

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-14704