PT-2025-13815 · Novastar · Novastar Cx40

Ninpwn · Published 2025-03-31 · Updated 2025-03-31 · CVE-2025-3007

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Novastar CX40 versions up to 2.44.0

Description A critical issue affects the getopt function of the /usr/nova/bin/netconfig file in the NetFilter Utility component. The manipulation of the cmd, netmask, pipeout, or nettask arguments leads to a stack-based buffer overflow. The exploit has been publicly disclosed.

Recommendations For Novastar CX40 versions up to 2.44.0, as a temporary workaround, consider disabling the getopt function in the /usr/nova/bin/netconfig file until a patch is available. Restrict access to the NetFilter Utility component to minimize the risk of exploitation. Avoid using the cmd, netmask, pipeout, or nettask arguments in the affected getopt function until the issue is resolved.

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2025-3007

Affected Products

Novastar Cx40

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-3007 · Security Note
• https://twitter.com/CVEnew/status/1906780380893413432 · Twitter Post
• https://vuldb.com/?submit.524867 · Note
• https://vuldb.com/?id.302057 · Note
• https://t.me/cvetracker/20387 · Telegram Post
• https://t.me/cvedetector/21654 · Telegram Post
• https://vuldb.com/?ctiid.302057 · Note