The vulnerability is a WebSocket control plane flaw that trusts client‐supplied identity and role fields in task messages, allowing an authenticated client to claim a higher‑privilege role. This can enable the attacker to dispatch arbitrary tasks to any connected device, effectively taking control of that device’s operations. The weakness corresponds to authentication and privilege control (CWE‑290), subverted authorization (CWE‑639), and authority control (CWE‑862).

Microsoft UFO, open‑source intelligent automation framework, versions circa 3.0.1-4-ge2626659. Any instance deploying that build and exposing the WebSocket control plane is vulnerable.

The CVSS score of 8.8 indicates high severity. EPSS is unavailable and the issue is not in CISA’s KEV catalog, but the flaw is authenticated and arises from trusting client data, so exploitation requires a valid WebSocket session and a shared server token. Once accessed, an attacker can run malicious tasks on any target device connected to the server.