CVE-2025-14706
Published: 15 December 2025
Summary
CVE-2025-14706 is a high-severity Injection (CWE-74) vulnerability in Sgwbox N3 Firmware. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 11.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-14706 is a command injection vulnerability in Shiguangwu sgwbox N3 version 2.0.25. It affects an unknown function in the file /usr/sbin/http_eshell_server within the NETREBOOT Interface component. Published on 2025-12-15, the flaw is associated with CWEs CWE-74 and CWE-77 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation without user interaction or privileges. Attackers can manipulate the affected component to inject commands, potentially compromising confidentiality, integrity, and availability with high impact.
Disclosure references from VulDB indicate the vendor was contacted early but provided no response, implying no official patches or mitigations are available. The exploit is publicly available and might be used; relevant details appear in VulDB entries (ctiid.336423, id.336423, submit.706975) and a Notion page on the sgwbox NAS N3 command injection.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-203333
Vulnerability details
A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the component NETREBOOT Interface. Such manipulation leads to command injection. The attack can be launched remotely. The exploit is publicly available…
more
and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote command injection in /usr/sbin/http_eshell_server (NETREBOOT Interface) enables exploitation of public-facing applications (T1190), exploitation of remote services (T1210), indirect command execution (T1202 as cited in advisory), and Unix Shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection in /usr/sbin/http_eshell_server by requiring validation and sanitization of all inputs to block malicious command insertion.
Mitigates the specific CVE-2025-14706 flaw through timely identification, patching, or workarounds despite lack of vendor response, including post-remediation verification.
Reduces impact of successful remote command injection by enforcing least privilege on the NETREBOOT interface processes, limiting executable commands.