CVE-2008-2654: Lavrsen Motion

High severity, CVSS 10.0. EPSS: 8% chance of exploitation in the next 30 days.

Off-by-one error in the read_client function in webhttpd.c in Motion 3.2.10 and earlier might allow remote attackers to execute arbitrary code via a long request to a Motion HTTP Control interface, which triggers a stack-based buffer overflow with some combinations of processor architecture and compiler.

Affected products

• Lavrsen Motion: up to and including 3.2.10; version 3.1.17 only; version 3.1.18 only; version 3.1.19 only; version 3.1.20 only; version 3.2.1 only; …

Published 2008-06-13. Last modified 2026-06-16.