CVE-2025-14704
📋 TL;DR
This vulnerability allows remote attackers to perform path traversal attacks via the /eshell API endpoint in Shiguangwu sgwbox N3 version 2.0.25. Attackers can potentially access files outside the intended directory structure. All systems running the affected version with the API exposed are vulnerable.
💻 Affected Systems
- Shiguangwu sgwbox N3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file read/write, potentially leading to credential theft, data exfiltration, or remote code execution.
Likely Case
Unauthorized access to sensitive files, configuration files, or user data stored on the NAS device.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the vulnerable API endpoint.
🎯 Exploit Status
The exploit has been made public and appears to be straightforward to execute based on the path traversal nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Block API Access
linuxRestrict network access to the vulnerable /eshell API endpoint using firewall rules.
iptables -A INPUT -p tcp --dport [API_PORT] -j DROP
ufw deny [API_PORT]
Disable Unnecessary API
allIf the eshell API functionality is not required, disable it completely in the device configuration.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the NAS device from untrusted networks
- Monitor for unusual file access patterns and API requests to the /eshell endpoint
🔍 How to Verify
Check if Vulnerable:
Check if the device is running version 2.0.25 and has the /eshell API endpoint accessible. Test with a path traversal payload like '../../etc/passwd' to the API endpoint.Check Version:
Check device web interface or system information page for firmware versionVerify Fix Applied:
Verify that path traversal attempts to the /eshell endpoint are blocked or return appropriate error responses.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Multiple requests to /eshell with '../' sequences
- Failed authentication attempts to API endpoints
Network Indicators:
- Traffic to /eshell endpoint with path traversal patterns
- Unusual outbound connections from NAS device
SIEM Query:
source="nas_logs" AND (uri="/eshell" AND (uri CONTAINS "../" OR uri CONTAINS "..\\"))