CVE-2019-16889: UI Ep-r6 Firmware

High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days.

Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container_file/ are created when providing a valid length payload of 249 characters or fewer to the beaker.session.id cookie in a GET header. The attacker can use a long series of unique session IDs.

Affected products

• UI Ep-r6 Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Ep-r8 Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Er-12 Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Er-4 Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Er-6p Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Er-8-XG Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Er-8 Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Er-X-Sfp Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Er-X Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Erlite-3 Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Erpoe-5 Firmware: before 2.0.3 (fixed in 2.0.3)
• UI Erpro-8 Firmware: before 2.0.3 (fixed in 2.0.3)

Published 2019-09-25. Last modified 2026-06-17.