CVE-2014-2324: Contec Sv-Cpt-MC310 Firmware

Medium severity, CVSS 5.0. EPSS: 29.5% chance of exploitation in the next 30 days.

Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.

Affected products

• Contec Sv-Cpt-MC310 Firmware: before 6.5 (fixed in 6.5)
• Debian Debian Linux: version 6.0 only; version 7.0 only; version 8.0 only
• Lighttpd Lighttpd: before 1.4.35 (fixed in 1.4.35)
• Opensuse Opensuse: version 11.4 only; version 12.3 only; version 13.1 only
• Suse Linux Enterprise High Availability Extension: version 11 only
• Suse Linux Enterprise Software Development Kit: version 11 only

Published 2014-03-14. Last modified 2026-06-17.