---

⚠️ Security Notice

This repository is intended for authorized security research, vulnerability validation, defensive testing, and controlled laboratory environments only.

The included checker is designed to perform non-destructive authentication-boundary checks.

It does not:

• Execute arbitrary MCP tools
• Control an Android device
• Execute ADB commands against a real device
• Capture screenshots
• Inject taps or swipes
• Launch applications
• Modify device state
• Attempt destructive exploitation

---

📌 Vulnerability Overview

CVE: CVE-2026-73296

Product: Microsoft UFO

Component: Mobile MCP HTTP Servers

Severity: Critical

CVSS v3.1: 9.4

Affected versions: <= v3.0.7

Officially patched versions: None listed by the Microsoft UFO advisory at the time of this documentation.

CWE:

• CWE-306 — Missing Authentication for Critical Function
• CWE-862 — Missing Authorization

The vulnerability affects UFO's Mobile MCP data-collection and action servers when they are exposed over a network without appropriate authentication.

The official advisory identifies the vulnerable implementation as:

ufo/client/mcp/http_servers/mobile_mcp_server.py

The affected services expose Streamable HTTP MCP interfaces that can interact with an ADB-connected Android device.

If the services are remotely reachable and authentication is not enforced, an unauthenticated network client may be able to access sensitive device information and invoke Android UI-control functionality.

---

🎯 Executive Summary

Microsoft UFO is an AI-agent framework designed for intelligent automation and multi-device orchestration.

Its Mobile MCP functionality provides MCP servers for interacting with Android devices through ADB.

The vulnerable configuration exposes two important network services:

Service	Port	Function
Mobile Data Collection MCP	8020	Android information and screen data
Mobile Action MCP	8021	Android interaction and control

In affected versions, the Mobile MCP servers could be created without an authentication provider or request-level authorization check.

Consequently:

Remote Client
      │
      │ HTTP / MCP
      ▼
┌──────────────────────┐
│ Mobile MCP Server    │
│                      │
│ Authentication:      │
└──────────┬───────────┘
           │
           ▼
      ADB Interface
           │
           ▼
    Android Device

The security boundary between the remote network client and the ADB-backed functionality is therefore insufficiently protected.

---

🔥 Severity

CVSS v3.1

9.4 CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Metrics

Metric	Value
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	Low

The vulnerability is particularly significant because exploitation does not inherently require:

• An authenticated UFO session
• A UFO/Galaxy API key
• A registered AIP client
• Browser interaction
• LLM cooperation
• User approval
• An existing agent task

The official advisory states that a network client able to reach the exposed service can initialize an MCP session and invoke its tools without presenting a credential.

---

🧩 Affected Versions

According to the official Microsoft UFO security advisory:

Affected:
    <= v3.0.7

Patched:
    None listed

The official repository currently lists 3.0.7 as a release.

Important: Do not claim that 3.0.8 is an officially patched release unless Microsoft publishes that information. The official security advisory currently lists no patched version.

---

🏗️ Vulnerable Architecture

The vulnerable functionality is implemented in:

ufo/client/mcp/http_servers/mobile_mcp_server.py

Important functions identified by the official advisory include:

Data Collection

create_mobile_data_collection_server
capture_screenshot
get_ui_tree
get_device_info
get_mobile_app_target_info
get_app_window_controls_target_info

Mobile Actions

create_mobile_action_server
tap
swipe
type_text
launch_app
press_key
click_control

The two HTTP services are associated with:

TCP/8020
TCP/8021

The advisory specifically identifies these services as the Mobile data-collection and action MCP servers.

---

🔬 Root Cause

The fundamental security problem is:

Powerful functionality
        +
Network exposure
        +
Missing authentication
        =
Unauthorized access

At the affected implementation, the Mobile MCP FastMCP servers were constructed without an authentication provider or equivalent request-level authorization enforcement.

Conceptually:

mcp = FastMCP(
    "Mobile MCP Server",
    host=host,
    port=port,
)

The problem is not simply the existence of MCP.

The problem is that a network-accessible interface exposes security-sensitive operations without requiring the caller to establish an authenticated identity.

---

🔗 Attack Flow

A simplified attack chain looks like this:

┌───────────────────┐
│ Unauthenticated   │
│ Network Client    │
└─────────┬─────────┘
          │
          │ HTTP
          ▼
┌─────────────────────────┐
│ Mobile MCP :8020/:8021  │
│                         │
│ Authentication missing  │
└───────────┬─────────────┘
            │
            │ MCP Tool
            ▼
┌─────────────────────────┐
│ Mobile MCP Tool         │
└───────────┬─────────────┘
            │
            │ ADB operation
            ▼
┌─────────────────────────┐
│ Android Device / ADB    │
└─────────────────────────┘

The important security transition is:

Unauthenticated network request
              ↓
       MCP functionality
              ↓
       ADB-backed action
              ↓
       Android device

---

📡 Exposed Services

Port 8020 — Data Collection

The data-collection server can expose functionality associated with:

capture_screenshot
get_ui_tree
get_device_info
get_mobile_app_target_info
get_app_window_controls_target_info

Potentially exposed information includes:

• Current screen contents
• UI hierarchy
• Device information
• Android version
• Device model
• Screen dimensions
• Display density
• Battery information
• Installed application information
• Window/control information

This creates a significant confidentiality risk.

---

🎮 Port 8021 — Mobile Actions

The action server exposes functionality associated with:

tap
swipe
type_text
launch_app
press_key
click_control

These operations can provide a remote caller with Android UI interaction capabilities.