CVE-2019-16889: ui ep-r6_firmware

Vulnerability summary

CVE-2019-16889 is a high (CVSS 7.8) vulnerability in ui ep-r6_firmware. EPSS estimates a 5.09% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 25-09-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container_file/ are created when providing a valid length payload of 249 characters or fewer to the beaker.session.id cookie in a GET header. The attacker can use a long series of unique session IDs.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.