Shiguangwu Sgwbox N3 Command Injection Vulnerability in NETREBOOT Interface

A command injection vulnerability has been identified in Shiguangwu Sgwbox N3 version 2.0.25. This issue affects the NETREBOOT interface, specifically an unknown function of the file '/usr/sbin/http_eshell_server'. The vulnerability allows unauthorized remote execution of commands on the affected NAS device by sending a crafted POST request to the command interface. The lack of proper input filtering for dangerous characters enables this exploitation. As a result, an unauthenticated attacker can gain root control over the device.

Impact

Exploitation of this vulnerability allows for unauthorized remote command execution, with root privileges, on the affected NAS device.