// For flags

CVE-2019-16889

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container_file/ are created when providing a valid length payload of 249 characters or fewer to the beaker.session.id cookie in a GET header. The attacker can use a long series of unique session IDs.

Los dispositivos Ubiquiti EdgeMAX versiones anteriores a 2.0.3, permiten a atacantes remotos causar una denegación de servicio (consumo de disco) porque los archivos *.cache en /var/run/beaker/container_file/ son creados cuando se proporciona una carga útil de longitud válida de 249 caracteres o menos para la cookie beaker.session.id en un encabezado GET. El atacante puede utilizar una larga serie de los ID de sesión únicos.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-09-25 CVE Reserved
  • 2019-09-25 CVE Published
  • 2019-12-22 First Exploit
  • 2024-08-05 CVE Updated
  • 2024-09-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ui
Search vendor "Ui"
Er-x Firmware
Search vendor "Ui" for product "Er-x Firmware"
< 2.0.3
Search vendor "Ui" for product "Er-x Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Er-x
Search vendor "Ui" for product "Er-x"
--
Safe
Ui
Search vendor "Ui"
Er-x-sfp Firmware
Search vendor "Ui" for product "Er-x-sfp Firmware"
< 2.0.3
Search vendor "Ui" for product "Er-x-sfp Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Er-x-sfp
Search vendor "Ui" for product "Er-x-sfp"
--
Safe
Ui
Search vendor "Ui"
Ep-r6 Firmware
Search vendor "Ui" for product "Ep-r6 Firmware"
< 2.0.3
Search vendor "Ui" for product "Ep-r6 Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Ep-r6
Search vendor "Ui" for product "Ep-r6"
--
Safe
Ui
Search vendor "Ui"
Erlite-3 Firmware
Search vendor "Ui" for product "Erlite-3 Firmware"
< 2.0.3
Search vendor "Ui" for product "Erlite-3 Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Erlite-3
Search vendor "Ui" for product "Erlite-3"
--
Safe
Ui
Search vendor "Ui"
Erpoe-5 Firmware
Search vendor "Ui" for product "Erpoe-5 Firmware"
< 2.0.3
Search vendor "Ui" for product "Erpoe-5 Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Erpoe-5
Search vendor "Ui" for product "Erpoe-5"
--
Safe
Ui
Search vendor "Ui"
Er-8 Firmware
Search vendor "Ui" for product "Er-8 Firmware"
< 2.0.3
Search vendor "Ui" for product "Er-8 Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Er-8
Search vendor "Ui" for product "Er-8"
--
Safe
Ui
Search vendor "Ui"
Erpro-8 Firmware
Search vendor "Ui" for product "Erpro-8 Firmware"
< 2.0.3
Search vendor "Ui" for product "Erpro-8 Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Erpro-8
Search vendor "Ui" for product "Erpro-8"
--
Safe
Ui
Search vendor "Ui"
Ep-r8 Firmware
Search vendor "Ui" for product "Ep-r8 Firmware"
< 2.0.3
Search vendor "Ui" for product "Ep-r8 Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Ep-r8
Search vendor "Ui" for product "Ep-r8"
--
Safe
Ui
Search vendor "Ui"
Er-4 Firmware
Search vendor "Ui" for product "Er-4 Firmware"
< 2.0.3
Search vendor "Ui" for product "Er-4 Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Er-4
Search vendor "Ui" for product "Er-4"
--
Safe
Ui
Search vendor "Ui"
Er-6p Firmware
Search vendor "Ui" for product "Er-6p Firmware"
< 2.0.3
Search vendor "Ui" for product "Er-6p Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Er-6p
Search vendor "Ui" for product "Er-6p"
--
Safe
Ui
Search vendor "Ui"
Er-12 Firmware
Search vendor "Ui" for product "Er-12 Firmware"
< 2.0.3
Search vendor "Ui" for product "Er-12 Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Er-12
Search vendor "Ui" for product "Er-12"
--
Safe
Ui
Search vendor "Ui"
Er-8-xg Firmware
Search vendor "Ui" for product "Er-8-xg Firmware"
< 2.0.3
Search vendor "Ui" for product "Er-8-xg Firmware" and version " < 2.0.3"
-
Affected
in Ui
Search vendor "Ui"
Er-8-xg
Search vendor "Ui" for product "Er-8-xg"
--
Safe