high7.5
CVE-2019-16889
Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container…
Impact
Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container_file/ are created when providing a valid length payload of 249 characters or fewer to the beaker.session.id cookie in a GET header. The attacker can use a long series of unique session IDs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ui | Er-X Firmware | before 2.0.3 |
| Ui | Er-X-Sfp Firmware | before 2.0.3 |
| Ui | Ep-R6 Firmware | before 2.0.3 |
| Ui | Erlite-3 Firmware | before 2.0.3 |
| Ui | Erpoe-5 Firmware | before 2.0.3 |
| Ui | Er-8 Firmware | before 2.0.3 |
| Ui | Erpro-8 Firmware | before 2.0.3 |
| Ui | Ep-R8 Firmware | before 2.0.3 |
| Ui | Er-4 Firmware | before 2.0.3 |
| Ui | Er-6p Firmware | before 2.0.3 |
| Ui | Er-12 Firmware | before 2.0.3 |
| Ui | Er-8-Xg Firmware | before 2.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://community.ui.com/releases/New-EdgeRouter-firmware-2-0-3-has-been-released-2-0-3/e8badd28-a112-4269-9fb6-ffe3fc0e1643
- https://hackerone.com/reports/406614
- https://mjlanders.com/2019/07/28/resource-consumption-dos-on-edgemax-v1-10-6/
- https://community.ui.com/releases/New-EdgeRouter-firmware-2-0-3-has-been-released-2-0-3/e8badd28-a112-4269-9fb6-ffe3fc0e1643
- https://hackerone.com/reports/406614
- https://mjlanders.com/2019/07/28/resource-consumption-dos-on-edgemax-v1-10-6/