High severity7.5NVD Advisory· Published Sep 25, 2019· Updated Jun 17, 2026

CVE-2019-16889

Description

Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container_file/ are created when providing a valid length payload of 249 characters or fewer to the beaker.session.id cookie in a GET header. The attacker can use a long series of unique session IDs.

Affected products

UI/Ep R6 Firmware
cpe:2.3:o:ui:ep-r6_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Ep R8 Firmware
cpe:2.3:o:ui:ep-r8_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Er 12 Firmware
cpe:2.3:o:ui:er-12_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Er 4 Firmware
cpe:2.3:o:ui:er-4_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Er 6p Firmware
cpe:2.3:o:ui:er-6p_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Er 8 Xg Firmware
cpe:2.3:o:ui:er-8-xg_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Er 8 Firmware
cpe:2.3:o:ui:er-8_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Er X Sfp Firmware
cpe:2.3:o:ui:er-x-sfp_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Er X Firmware
cpe:2.3:o:ui:er-x_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Erlite 3 Firmware
cpe:2.3:o:ui:erlite-3_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Erpoe 5 Firmware
cpe:2.3:o:ui:erpoe-5_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
UI/Erpro 8 Firmware
cpe:2.3:o:ui:erpro-8_firmware:*:*:*:*:*:*:*:*
Range: <2.0.3
Ubiquiti/EdgeMAXdescription
Ubiquiti Inc/EdgeMAXllm-fuzzy
Range: <2.0.3

Patches

Vulnerability mechanics

References

community.ui.com/releases/New-EdgeRouter-firmware-2-0-3-has-been-released-2-0-3/e8badd28-a112-4269-9fb6-ffe3fc0e1643nvdPatchVendor Advisory
hackerone.com/reports/406614nvdExploitIssue TrackingThird Party Advisory
mjlanders.com/2019/07/28/resource-consumption-dos-on-edgemax-v1-10-6/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000