CVE-2008-2654: Off-by-one error in the read_client function in webhttpd.c in Motion 3.2.10 and earlier might allow remote...

Security readout for executives and security teams

CVE-2008-2654 is an old Motion web control interface memory bug. A specially long HTTP request may crash the service or, in some architecture/compiler combinations, allow arbitrary code execution. Business risk is highest where legacy Motion control interfaces are reachable over a network. Exposure is likely limited to systems running Motion 3.2.10 or earlier with the HTTP Control interface enabled and reachable. Internet-facing or broadly reachable management interfaces carry the most concern. The supplied source data does not identify modern affected package versions or all downstream backports. Treat as a legacy high-priority exposure review, not an internet-wide emergency based on supplied evidence. Patch or isolate reachable Motion control interfaces first, especially in monitoring environments where compromise could affect surveillance, availability, or internal network access. Mitigation focus: Identify and upgrade Motion 3.2.10 or earlier installations using vendor or distribution guidance.; Apply the upstream webhttpd security diff or distribution backport where upgrade is not immediate.; Restrict the Motion HTTP Control interface to trusted networks until patched..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.