CVE-2025-14707
Published: 15 December 2025
Summary
CVE-2025-14707 is a critical-severity Injection (CWE-74) vulnerability in Sgwbox N3 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 14.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validating and sanitizing inputs such as the 'params' argument to directly prevent command injection in /usr/sbin/http_eshell_server.
SI-2 mandates timely flaw remediation for vulnerabilities like CVE-2025-14707, eliminating the command injection risk through patching or equivalent measures.
AC-6 enforces least privilege on the affected Docker feature process, limiting the scope and impact of arbitrary command execution even if injection succeeds.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated command injection (CWE-77) in public-facing http_eshell_server enables exploitation of public-facing applications (T1190), indirect command execution (T1202), and adversary execution via Unix Shell (T1059.004).
NVD Description
A security flaw has been discovered in Shiguangwu sgwbox N3 2.0.25. Affected is an unknown function of the file /usr/sbin/http_eshell_server of the component DOCKER Feature. Performing manipulation of the argument params results in command injection. The attack may be initiated…
more
remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-14707 is a command injection vulnerability affecting Shiguangwu sgwbox N3 version 2.0.25. The flaw resides in an unknown function within the file /usr/sbin/http_eshell_server of the DOCKER Feature component, where manipulation of the "params" argument enables arbitrary command execution. It is associated with CWEs-74 and CWE-77 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability is exploitable remotely by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation allows attackers to inject and execute arbitrary commands on the affected system, potentially leading to full compromise with high impacts on confidentiality, integrity, and availability.
Advisories from VulDB detail the issue and note that the vendor was contacted early for disclosure but provided no response. No patches or specific mitigations are referenced in the available information.
An exploit for this vulnerability has been publicly released, heightening the potential for real-world attacks.
Details
- CWE(s)