CVE-2025-14704 is a high severity path traversal (CVSS 7.3) in the /eshell API of the Shiguangwu sgwbox N3 network storage device, version 2.0.25. The record lists no fix, and says the vendor did not respond. Isolate the device from the internet and review what it stores.
What's affected
The record names the Shiguangwu sgwbox N3, firmware or software version 2.0.25. The affected element is an unknown function of the file /eshell, part of the API component. The manipulation leads to path traversal.
- Severity: High, CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Network reachable, no privileges and no user interaction needed, per the vector.
- Impact is scored low for confidentiality, integrity and availability.
- Fixed version: none listed.
- The record says the vendor was contacted early and did not respond in any way.
- Exploitation in the wild: not in CISA KEV. The record says the exploit has been made public.
A public write up on Notion is linked from the record. This post does not reproduce its details.
How to check if you're exposed
Log in to the device's admin page and read the version number. If it shows 2.0.25, it matches the record. The record does not describe other versions, so a different number is not proof of safety, just a lack of information.
Then ask whether the device can be reached from the internet. Check your router for port forwards and any cloud relay feature the device offers. From outside your network, test whether the device's web interface answers at all.
# On your router or firewall, list rules that forward to the NAS address
# (command depends on the router; this is a generic reminder)
# On a host in the same network, confirm which ports the NAS listens on
nmap -p- 192.0.2.50
Replace the sample address with your own. Only scan devices you own.
What to do now
- Inventory every sgwbox N3 you run and note its version.
- Remove any internet exposure: delete port forwards and turn off remote access features.
- Restrict access to a trusted segment or VPN.
- Make a verified backup of the data to a separate location, since you cannot count on a patch.
- Check for a firmware update on the vendor's channels. The record offers none, and the vendor did not reply to the reporter.
- Review which files the device holds, and move anything sensitive to a platform that receives updates.
- Plan a replacement if the vendor stays silent.
Why it matters
Path traversal is CWE-22: the software builds a file path from input and does not stop the path from escaping the directory it was meant to stay in. On a storage device, the files within reach may include other users' data or configuration.
The detail that matters most here is the unresponsive vendor. When a vendor does not acknowledge a report, there may be no patch, and the burden of mitigation falls on the owner. Network isolation then becomes the main control. Devices sold for home and small business use are often left on the open network, which is exactly what this advice is meant to prevent.
Quick check
Is there a patch for the sgwbox N3?
The record lists no fixed version and states the vendor did not respond. Check the vendor's channels, but plan on isolating the device and replacing it if nothing appears.
Is a NAS behind a home router safe from this?
Only if it is not reachable from outside and your internal network is trusted. The vector scores network access with no privileges, so any host that can reach the device is a potential source.
Sources
Last reviewed: 19 October 2026.
