The vulnerability arises from Microsoft UFO’s open‑source framework exposing two HTTP Mobile Control Protocol services on non‑secured ports 8020 and 8021 before version 3.0.8. The services accept commands such as capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control over a TCP connection without any authentication. An attacker who can reach those ports can thus read the screen contents, obtain UI hierarchies, interact with the Android UI, launch applications, simulate key presses, and modify the device state, effectively gaining remote control of the device. The flaw maps to CWE‑306 and CWE‑862, reflecting missing authentication and authorization for sensitive operations.

The flaw affects the Microsoft UFO framework, specifically any installation using the mobile_mcp_server component that runs before release 3.0.8. Users deploying UFO version 3.0.7 or earlier on servers that expose ports 8020 and 8021 are vulnerable. The issue is fixed in UFO 3.0.8 and later releases.

The vulnerability has a CVSS score of 9.4, indicating a high severity. The EPSS score is 3%, suggesting a moderate likelihood of exploitation, and the flaw is not listed in CISA KEV. The attack vector is remote over the network: an unauthenticated attacker only needs to reach the TCP ports and have an ADB‑connected Android device to exploit the flaw. Once accessed, the attacker can execute any of the exposed commands without restriction, leading to full device compromise. Given the lack of authentication, exploitation risk is high and the vulnerability is potentially exploitable by anyone with network connectivity to the target.