CVE-2026-54568

🗓️ 16 Jul 2026 15:32:06Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 47 Views🌐 WEB

Missing authorization in device information requests allows reading another device's system info; fixed in version 3.0.6.

Reporter	Title	Published	Views	Family All 6
ATTACKERKB	CVE-2026-54568	16 Jul 202615:32	–	attackerkb
Cvelist	CVE-2026-54568 Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info	16 Jul 202615:32	–	cvelist
EUVD	EUVD-2026-44943	16 Jul 202615:32	–	euvd
NVD	CVE-2026-54568	16 Jul 202616:19	–	nvd
Positive Technologies	PT-2026-60495	16 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-54568 Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info	16 Jul 202615:32	–	vulnrichment

[
  {
    "vendor": "microsoft",
    "product": "UFO",
    "versions": [
      {
        "version": ">= 3.0.0, < 3.0.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/microsoft/UFO/commit/2558da4e7dd05096aa6b489eca64efed96126713
github	www.github.com/microsoft/UFO/releases/tag/3.0.6
github	www.github.com/microsoft/UFO/security/advisories/GHSA-hc27-j4p9-qm2x

Parameter	Position	Path	Description	CWE
target_id	path	ufo/server/ws/handler.py	Unauthorized access to another device's system_info via DEVICE_INFO_REQUEST over WebSocket due to missing device-scoped authorization; fixed in 3.0.6.	CWE-639, CWE-862

16 Jul 2026 19:16Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.14.3

EPSS0.00977

SSVC