Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device, disclose screen and device data, and modify device state. This issue is fixed in version 3.0.8.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
microsoft:ufo
References 3
https://github.com/microsoft/UFO/security/advisories/GHSA-24fq-m9rr-g3mm
https://github.com/microsoft/UFO/security/advisories/GHSA-24fq-m9rr-g3mm
https://github.com/microsoft/UFO/commit/e562d10060b077dedae93e0fd58c1ee379558962
https://github.com/microsoft/UFO/commit/e562d10060b077dedae93e0fd58c1ee379558962
https://github.com/microsoft/UFO/releases/tag/v3.0.8
https://github.com/microsoft/UFO/releases/tag/v3.0.8