This vulnerability in BlackBerry UEM Management Console (version 12.23.0 QF8 and earlier) is caused by improper input validation leading to improper neutralization of special elements in output (CWE-74). This flaw allows an attacker to perform arbitrary file download and potentially cause denial of service conditions. The CVSS 4.0 base score is 5.9, indicating medium severity, with network attack vector, high attack complexity, no privileges required, and user interaction needed. There is no vendor advisory or patch information currently available, and the affected versions are not explicitly stated beyond the mention of 12.23.0 QF8 and earlier.

An attacker could exploit this vulnerability to download arbitrary files from the affected system and potentially cause denial of service. This could lead to unauthorized access to sensitive files and disruption of service availability. The attack requires user interaction and has high attack complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations or workarounds are provided in the available data.