A client acting as a DEVICE connected to the Microsoft UFO WebSocket server can issue a DEVICE_INFO_REQUEST for any other device by specifying that device’s target_id. Instead of enforcing the proper constellation‑only role or object‑level authorization, the server returns the target device’s system_info data. This allows an attacker to read sensitive configuration or operating environment details about another device. The flaw is a classic example of missing authorization (CWE‑639) and improper role enforcement (CWE‑862).

The vulnerability affects Microsoft UFO versions 3.0.0 through 3.0.6. Systems running these releases expose their device system information to any connected DEVICE client, regardless of its identity or intended scope.

The CVSS score of 4.3 indicates a moderate severity impact, primarily confidentiality but not exposing a critical attack surface. Because the exploit requires a connection to the UFO WebSocket endpoint and the ability to craft a DEVICE_INFO_REQUEST, an attacker needs network access to the server and the capability to establish a device session. The EPSS score of < 1% indicates a very low likelihood of exploitation, yet the issue is not listed in the CISA KEV catalog. The attack vector is inferred as remote over the WebSocket protocol, and the flaw is fixed in UFO 3.0.6.