Christian Becker

Improper neutralization of input during web page generation in the BlackBerry UEM Management Console allows Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

Improper input validation in the BlackBerry UEM Management Console allows for arbitrary file download and potential denial of service. This occurs when the system fails to properly verify the input provided to the console, enabling an attacker to retrieve sensitive files or crash the service.

The issue is related to unsanitized user input in the TR069 API, which allows remote unauthenticated attackers to cause a permanent Denial of Service via crafted TR069 requests on TCP port 9675 or 7547. Rebooting does not resolve the permanent Denial of Service.