CVE-2025-14709
Published: 15 December 2025
Summary
CVE-2025-14709 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Sgwbox N3 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the 'params' argument to prevent buffer overflows from malformed input in the WIRELESSCFGGET interface.
Implements memory protections such as address space layout randomization and data execution prevention to mitigate exploitation of the buffer overflow vulnerability.
Mandates timely remediation of known flaws like this unpatched buffer overflow through patching, workarounds, or system isolation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing HTTP interface (WIRELESSCFGGET) allows unauthenticated remote exploitation for RCE, directly mapping to Exploit Public-Facing Application.
NVD Description
A security vulnerability has been detected in Shiguangwu sgwbox N3 2.0.25. Affected by this issue is some unknown functionality of the file /usr/sbin/http_eshell_server of the component WIRELESSCFGGET Interface. The manipulation of the argument params leads to buffer overflow. Remote exploitation…
more
of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-14709 is a buffer overflow vulnerability in Shiguangwu sgwbox N3 version 2.0.25. The flaw affects an unknown functionality within the /usr/sbin/http_eshell_server file of the WIRELESSCFGGET Interface component, triggered by manipulation of the "params" argument. It is classified under CWE-119 and CWE-120, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers can exploit this vulnerability without authentication or user interaction, requiring only network access to the affected interface. Successful exploitation enables high-impact consequences, including unauthorized disclosure of sensitive data, modification of system resources, and denial of service, potentially leading to complete compromise of the device.
Advisories from VulDB indicate that the vendor was notified early about the issue but provided no response or patches. The exploit has been publicly disclosed, with details available via VulDB entries (ctiid.336426, id.336426, submit.706989) and a Notion page documenting the sgwbox NAS N3 buffer overflow. Security practitioners should isolate affected devices and monitor for exploitation attempts until mitigations are available.
Details
- CWE(s)