Vulnerability · Published Dec 15, 2025 · Assigned by VulDB
CVE-2025-14704Shiguangwu sgwbox N3 API eshell path traversal
High 7.3
In plain English
A high-severity path traversal in sgwbox N3 from Shiguangwu. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 12.5% (higher than 96% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)12.5%top 3.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shiguangwu | sgwbox N3 | 2.0.25 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-336421 | Shiguangwu sgwbox N3 API eshell path traversal vdb-entry
- VDB-336421 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #706915 | sgwbox N3 NAS V2.0.25 Directory Traversal third-party-advisory
- https://www.notion.so/sgwbox-NAS-N3-Directory-Traversal-2be6cf4e528a802a9c0ad6f01b75694e?source=copy_link exploit