# NovaStar CX40 LED controller overflow and injection flaws (CVE-2025-3007, CVE-2025-3008)

- Date: 2025
- Location: Global
- Type: Vulnerability
- Sector: Other
- CVE: CVE-2025-3007, CVE-2025-3008

NovaStar CX40 4K LED controllers at version 2.44.0 and earlier have a stack-based overflow in the NetFilter Utility's netconfig handling (CVE-2025-3007, rated critical). The same utility has a command injection flaw (CVE-2025-3008). Neither had public proof-of-concept code when the database entries were captured.

## Sources

- [CVE-2025-3007](https://nvd.nist.gov/vuln/detail/CVE-2025-3007) (NIST NVD)
- [CVE-2025-3008](https://nvd.nist.gov/vuln/detail/CVE-2025-3008) (NIST NVD)

Page: https://signagelist.org/incidents/2025-novastar-cx40-led-controller-overflow-and-injection/