Critical · published December 15, 2025
🚨 A sneaky command injection flaw in Shiguangwu's sgwbox N3 2.0.25 could let attackers remotely run commands without breaking a sweat! 🔥 This vulnerability is like a restaurant with a poorly trained staff that takes any order without verification — imagine someone calling in and asking for a secret recipe straight from the kitchen! That’s how this command injection flaw operates with the Docker feature. An attacker could exploit this to execute arbitrary commands on the server, potentially taking full control of the system, leaking sensitive data, or causing widespread disruption. It’s a nightmare scenario where your server turns against you, making it critical to address this immediately!
This vulnerability is like a restaurant with a poorly trained staff that takes any order without verification — imagine someone calling in and asking for a secret recipe straight from the kitchen! That’s how this command injection flaw operates with the Docker feature. The vulnerability arises from improper handling of parameters in the /usr/sbin/http_eshell_server function within the Docker feature of sgwbox, allowing remote attackers to inject and execute arbitrary commands.
An attacker could exploit this to execute arbitrary commands on the server, potentially taking full control of the system, leaking sensitive data, or causing widespread disruption. It’s a nightmare scenario where your server turns against you, making it critical to address this immediately! To secure your environment, update to the latest version of sgwbox immediately. Ensure your configurations are hardened and consider implementing additional security measures like network segmentation. Don't wait until the next breach! You’ve got this! With the right steps, you can safeguard your systems and earn your security hero badge! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| sgwbox/n3_firmware | ≤ 2.0.25 | — |