CVEvulnerability

CVE-2019-16889

7.5 HIGH Published 2019-09-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-770

Description

Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container_file/ are created when providing a valid length payload of 249 characters or fewer to the beaker.session.id cookie in a GET header. The attacker can use a long series of unique session IDs.

Affected configurations

• ui er-x firmware (< 2.0.3) • ui er-x-sfp firmware (< 2.0.3) • ui ep-r6 firmware (< 2.0.3) • ui erlite-3 firmware (< 2.0.3) • ui erpoe-5 firmware (< 2.0.3) • ui er-8 firmware (< 2.0.3) • ui erpro-8 firmware (< 2.0.3) • ui ep-r8 firmware (< 2.0.3) • ui er-4 firmware (< 2.0.3) • ui er-6p firmware (< 2.0.3) • ui er-12 firmware (< 2.0.3) • ui er-8-xg firmware (< 2.0.3)

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References