CVE-2026-54568: falha de média gravidade em microsoft UFO
Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.6%
Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
microsoft · UFOCVEs relacionadas — microsoft UFO
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73296CRITICALMicrosoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosureEPSS 3.7%CVE-2026-73297MEDIUMMicrosoft UFO: IPv6 transition address bypass of SSRF guard in URL validationEPSS 2.9%CVE-2026-45322HIGHOS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSONEPSS 2.4%CVE-2026-105788HIGHMicrosoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_appEPSS 1.1%CVE-2026-105793CRITICALMicrosoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`EPSS 0.9%CVE-2026-46402HIGHMicrosoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directoryEPSS 0.7%