CVE-2025-14707
CriticalSummary
A vulnerability was detected in Shiguangwu sgwbox N3 2.0.25 in the file /usr/sbin/http_eshell_server in the DOCKER feature. Manipulation of the argument params leads to command injection. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
Remote execution of arbitrary commands on the device, potentially leading to full compromise. Public exploit increases the risk.
Recommendation
Apply updates or patches from the vendor if available. Restrict access to the device from external networks.
Original NVD description (English source)
A security flaw has been discovered in Shiguangwu sgwbox N3 2.0.25. Affected is an unknown function of the file /usr/sbin/http_eshell_server of the component DOCKER Feature. Performing manipulation of the argument params results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.