Description

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device, disclose screen and device data, and modify device state. This issue is fixed in version 3.0.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-08-12T17:17:32.780Z",
  "pubdate": "2026-08-12T17:17:32.780Z",
  "executiveSummary": "An unauthenticated remote code execution and device control vulnerability exists in the Microsoft UFO open-source framework prior to version 3.0.8.\nThe vulnerability resides within the create_mobile_data_collection_server and create_mobile_action_server functions located in ufo/client/mcp/http_servers/mobile_mcp_server.py.\nSpecifically, these functions expose Streamable HTTP Model Context Protocol (MCP) services on TCP ports 8020 and 8021 completely devoid of any authentication mechanisms.\nAn unauthenticated remote attacker with network access to the host can directly interact with these exposed endpoints to invoke sensitive actions including capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against any ADB-connected Android device.\nThe business impact includes severe data disclosure of sensitive screen and device information, as well as unauthorized modification of device state.\nExploitation requires network reachability to the exposed TCP ports and an active Android Debug Bridge (ADB) connection to a target device.\nThe risk is mitigated by updating the Microsoft UFO framework to version 3.0.8 or later.",
  "technicalDetails": "The root cause of the vulnerability stems from the insecure instantiation and exposure of Model Context Protocol (MCP) HTTP servers without access controls or authentication layers.\nThe vulnerable component is identified as ufo/client/mcp/http_servers/mobile_mcp_server.py, specifically within the create_mobile_data_collection_server and create_mobile_action_server routines.\nThese functions initialize and bind Streamable HTTP MCP services to TCP ports 8020 and 8021 on the network interface.\nBecause the implementation lacks session validation, token verification, or IP restriction mechanisms, any remote entity capable of routing packets to TCP ports 8020 and 8021 can issue arbitrary commands.\nThe attack flow begins when an unauthenticated remote attacker scans for or targets the exposed TCP ports 8020 and 8021 associated with the Microsoft UFO mobile MCP server.\nThe attacker sends crafted HTTP requests to the Streamable HTTP MCP service endpoints.\nUpon receiving the requests, the server processes the commands and interfaces directly with the ADB-connected Android device.\nThe attacker can successfully invoke functions such as capture_screenshot and get_ui_tree to harvest sensitive screen contents and device telemetry.\nFurthermore, the attacker can execute state-modifying actions including tap, swipe, type_text, launch_app, press_key, and click_control.\nThis enables remote tampering with the Android device, execution of arbitrary application workflows, and potential cascading security compromises depending on the applications installed and running on the target device.\nThe affected product is the Microsoft UFO open-source framework in versions prior to 3.0.8.\nThe vulnerability requires no authentication and no privileges, and is exposed over the network via TCP protocols."
}