CVE-2020-26566 – CVE-2020-26566 is a denial-of-service vulnerabi... (How to Fix)

Q: What is the severity of CVE-2020-26566?

CVE-2020-26566 has a CVSS score of 7.5 (HIGH). CVE-2020-26566 is a denial-of-service vulnerability in Motion-Project Motion's web interface (webu.c) that allows remote unauthenticated attackers to crash the main process via a crafted HTTP request. This affects all users running Motion versions 3.2 through 4.3.1 with the web interface enabled.

📋 TL;DR

CVE-2020-26566 is a denial-of-service vulnerability in Motion-Project Motion's web interface (webu.c) that allows remote unauthenticated attackers to crash the main process via a crafted HTTP request. This affects all users running Motion versions 3.2 through 4.3.1 with the web interface enabled.

💻 Affected Systems

Products:

Motion-Project Motion

Versions: 3.2 through 4.3.1

Operating Systems: Linux, BSD, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Only vulnerable when web interface (webu) is enabled and accessible. The vulnerability is in the webu.c component.

📦 What is this software?

Motion by Motion Project

View all CVEs affecting Motion →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service disruption where the Motion surveillance/monitoring application crashes and stops recording/processing video streams until manually restarted.

🟠

Likely Case

Temporary service interruption requiring manual restart of the Motion service, potentially causing gaps in surveillance coverage.

🟢

If Mitigated

Minimal impact if web interface is disabled or network access is restricted to trusted sources only.

🌐 Internet-Facing: HIGH - Remote unauthenticated exploitation makes internet-facing instances particularly vulnerable to simple DoS attacks.

🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could still exploit this to disrupt surveillance services.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The GitHub issue contains technical details about the crash. Crafting the malicious HTTP request requires minimal technical skill.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.3.2 and later

Vendor Advisory: https://github.com/Motion-Project/motion/releases

Restart Required: Yes

Instructions:

1. Backup current configuration. 2. Stop Motion service. 3. Update to Motion 4.3.2 or later via package manager or source compilation. 4. Restart Motion service.

🔧 Temporary Workarounds

Disable web interface

linux

Disable the vulnerable webu component if not required

Edit motion.conf and set 'webcontrol_port 0' or 'webcontrol_localhost on'

Restrict network access

linux

Use firewall rules to limit access to Motion web interface

iptables -A INPUT -p tcp --dport [webcontrol_port] -s [trusted_ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [webcontrol_port] -j DROP

🧯 If You Can't Patch

Disable the web interface entirely by setting webcontrol_port to 0 in motion.conf
Implement strict network segmentation and firewall rules to limit access to Motion service only from trusted management networks

🔍 How to Verify

Check if Vulnerable:

Check Motion version with 'motion -h' or 'dpkg -l | grep motion' and verify if between 3.2 and 4.3.1 inclusive

Check Version:

motion -h | grep Version || dpkg -l | grep motion || rpm -qa | grep motion

Verify Fix Applied:

Confirm version is 4.3.2 or later and test web interface functionality

📡 Detection & Monitoring

Log Indicators:

Segmentation fault errors in system logs
Motion process crashes
Web interface access logs showing malformed requests

Network Indicators:

HTTP requests to Motion web interface with unusual patterns or malformed headers

SIEM Query:

process_name:"motion" AND (event_type:"crash" OR error_message:"segmentation fault")

📊 Metadata

CVE ID: CVE-2020-26566

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-125

Published: October 26, 2020

Last Updated: November 21, 2024

🔗 References

https://github.com/Motion-Project/motion/issues/1227#issuecomment-715927776 Exploit,Issue Tracking,Third Party Advisory
https://github.com/Motion-Project/motion/releases Release Notes,Third Party Advisory
https://motion-project.github.io/index.html Product
https://security.gentoo.org/glsa/202208-18 Third Party Advisory
https://github.com/Motion-Project/motion/issues/1227#issuecomment-715927776 Exploit,Issue Tracking,Third Party Advisory
https://github.com/Motion-Project/motion/releases Release Notes,Third Party Advisory
https://motion-project.github.io/index.html Product
https://security.gentoo.org/glsa/202208-18 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-26566, you might also want to check these: