CVE-2019-16889

Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container_file/ are created when providing a valid length payload of 249 characters or fewer to the beaker.session.id cookie in a GET header. The attacker can use a long series of unique session IDs.

• CWE-770

• https://community.ui.com/releases/New-EdgeRouter-firmware-2-0-3-has-been-released-2-0-3/e8badd28-a112-4269-9fb6-ffe3fc0e1643Patch, Vendor Advisory
• https://hackerone.com/reports/406614Exploit, Issue Tracking, Third Party Advisory
• https://mjlanders.com/2019/07/28/resource-consumption-dos-on-edgemax-v1-10-6/Exploit, Third Party Advisory
• https://community.ui.com/releases/New-EdgeRouter-firmware-2-0-3-has-been-released-2-0-3/e8badd28-a112-4269-9fb6-ffe3fc0e1643Patch, Vendor Advisory
• https://hackerone.com/reports/406614Exploit, Issue Tracking, Third Party Advisory
• https://mjlanders.com/2019/07/28/resource-consumption-dos-on-edgemax-v1-10-6/Exploit, Third Party Advisory

Published

Sep 25, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16880An issue was discovered in the linea crate through 0.9.4 for…9.8
• CVE-2019-16881An issue was discovered in the portaudio-rs crate through 0.…9.8
• CVE-2019-16882An issue was discovered in the string-interner crate before …7.5
• CVE-2019-16884runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce…7.5
• CVE-2019-16885In OkayCMS through 2.3.4, an unauthenticated attacker can ac…9.8
• CVE-2019-16887In IrfanView 4.53, Data from a Faulting Address controls a s…7.8
• CVE-2019-1689A vulnerability in the client application for iOS of Cisco W…7.3
• CVE-2019-16890Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to a…5.4
• CVE-2019-16891Liferay Portal CE 6.2.5 allows remote command execution beca…9.8
• CVE-2019-16892In Rubyzip before 1.3.0, a crafted ZIP file can bypass appli…5.5
• CVE-2019-16893The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181…7.5
• CVE-2019-16894download.php in inoERP 4.15 allows SQL injection through ins…9.8