CVE-2025-14705

high · 8.9

A vulnerability was determined in Shiguangwu sgwbox N3 2.0.25. This affects an unknown function of the component SHARESERVER Feature. This manipulation of the argument params causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

8.9

CVSS

16.5%

EPSS (exploit prob.)

97th

EPSS percentile

2025-12-15

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
sgwbox	n3_firmware	<= 2.0.25
sgwbox	n3	all versions

Check a specific version with /api/v1/cve/match.

References

https://vuldb.com/?ctiid.336422
https://vuldb.com/?id.336422
https://vuldb.com/?submit.706974
https://www.notion.so/sgwbox-NAS-N3-Command-Injection-2be6cf4e528a80d69da5d6d17456a183?source=copy_link

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-14705