This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A critical **Command Injection** flaw in SGWBox N3 NAS. <br>π₯ **Consequences**: Attackers can execute arbitrary system commands, leading to total device compromise, data theft, or ransomware deployment.
Q2Root Cause? (CWE/Flaw)
π‘οΈ **Root Cause**: **CWE-77** (Command Injection). <br>π **Flaw**: Improper handling of the `params` argument in `/usr/sbin/http_eshell_server`. Malicious input bypasses validation and injects shell commands.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: **Shiguangwu SGWBox N3**. <br>π **Version**: Specifically **v2.0.25**. <br>β οΈ **Note**: Check if your NAS runs this exact firmware version.
Q4What can hackers do? (Privileges/Data)
π **Privileges**: Likely **Root/System** level access due to the nature of command injection in system binaries.β¦
β‘ **Threshold**: **LOW**. <br>π **Auth**: CVSS vector `PR:N` implies **No Privileges** required. <br>π **Access**: `AV:N` means exploitable over the **Network** remotely.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Exploit Status**: **Yes**. <br>π **Evidence**: References include a Notion page tagged as 'exploit' and VDB entries. Public PoCs or detailed exploitation guides are likely circulating.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: <br>1. Log into SGWBox Web UI. <br>2. Navigate to **System Info** or **About**. <br>3. Verify Firmware Version is **NOT** `2.0.25`. <br>4. Scan for open ports exposing `http_eshell_server` endpoints.
π **Workaround**: <br>1. **Disable** remote access to the NAS immediately. <br>2. Restrict access to `http_eshell_server` via firewall rules. <br>3. Change all admin passwords to complex, unique strings.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: **CRITICAL (P1)**. <br>β±οΈ **Priority**: Patch immediately. CVSS Score is **High** (likely 9.8+). Remote, unauthenticated execution makes this an immediate threat to data integrity.