Christian Becker

**Name of the Vulnerable Software and Affected Versions** BlackBerry UEM versions prior to 12.23.0 QF9 **Description** Improper neutralization of input during web page generation in the BlackBerry UEM Management Console allows Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. **Recommendations** Update to a version newer than 12.23.0 QF8.

**Name of the Vulnerable Software and Affected Versions** BlackBerry UEM versions prior to 12.23.0 QF9 **Description** Improper input validation in the BlackBerry UEM Management Console allows for arbitrary file download and potential denial of service. This occurs when the system fails to properly verify the input provided to the console, enabling an attacker to retrieve sensitive files or crash the service. **Recommendations** Update BlackBerry UEM to version 12.23.0 QF9 or later.

**Name of the Vulnerable Software and Affected Versions** AXESS ACS (Auto Configuration Server) versions prior to 5.2.0 **Description** The issue is related to unsanitized user input in the TR069 API, which allows remote unauthenticated attackers to cause a permanent Denial of Service via crafted TR069 requests on TCP port 9675 or 7547. Rebooting does not resolve the permanent Denial of Service. **Recommendations** For AXESS ACS (Auto Configuration Server) versions prior to 5.2.0, as a temporary workaround, consider disabling the TR069 API until a patch is available. Restrict access to the TR069 API on TCP port 9675 or 7547 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.