PT-2025-39375 · Unknown · Adb Mcp Server

Published 2025-09-24 · Updated 2025-09-25 · CVE-2025-59834

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions**

ADB MCP Server versions 0.1.0 and prior

**Description**

ADB MCP Server, a Model Context Protocol server for interacting with Android devices through ADB, contains a flaw in its implementation. Versions 0.1.0 and earlier are susceptible to command injection attacks due to the way the MCP Server is written. The issue stems from the tool definition and implementation of the MCP Server. A patch is available via commit 041729c.

**Recommendations**

Update ADB MCP Server to a version later than 0.1.0, or apply commit 041729c.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2025-59834

GHSA-54J7-GRVR-9XWG

Affected Products

Adb Mcp Server

References · 10

• 🔥 https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59834 · Security Note
• https://osv.dev/vulnerability/GHSA-54j7-grvr-9xwg · Vendor Advisory
• https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355 · Note
• https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c · Note
• https://github.com/srmorete/adb-mcp · Note
• https://twitter.com/CveFindCom/status/1971215551281143932 · Twitter Post
• https://twitter.com/CVEnew/status/1971211273393078781 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971228042031718792 · Twitter Post
• https://t.me/CVEtracker/33318 · Telegram Post