PT-2025-39375 · Unknown · Adb Mcp Server

Published 2025-09-24 · Updated 2025-09-25 · CVE-2025-59834

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADB MCP Server versions 0.1.0 and prior

Description ADB MCP Server, a Model Context Protocol server for interacting with Android devices through ADB, contains a flaw in its implementation. Versions 0.1.0 and earlier are susceptible to command injection attacks due to the way the MCP Server is written. The issue stems from the tool definition and implementation of the MCP Server. A patch is available via commit 041729c.

Recommendations Update ADB MCP Server to a version later than 0.1.0, or apply commit 041729c.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2025-59834

GHSA-54J7-GRVR-9XWG

Affected Products

Adb Mcp Server

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59834.json · Exploit
• 🔥 https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg · Exploit
• https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c · Patch
• https://osv.dev/vulnerability/CVE-2025-59834 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59834 · Security Note
• https://osv.dev/vulnerability/GHSA-54j7-grvr-9xwg · Vendor Advisory
• https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355 · Note
• https://github.com/srmorete/adb-mcp · Note
• https://t.me/cveNotify/136402 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971228042031718792 · Twitter Post
• https://twitter.com/CVEnew/status/1971211273393078781 · Twitter Post
• https://t.me/CVEtracker/33318 · Telegram Post
• https://twitter.com/CveFindCom/status/1971215551281143932 · Twitter Post