CVE-2026-59104: UgCS server HCI authentication bypass with empty credentials
UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only user\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UgCS serverto a version that resolves this vulnerability.Fixed in 6.2
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
UgCS server versions before 6.2 are exposed when the user database contains exactly one user, which is the default single-operator installation. The affected HCI service listens on TCP port 3334 on all interfaces by default.
What does an attacker need to exploit it?
An attacker only needs network access to TCP port 3334. They can send a LoginRequest with empty userLogin and userPassword fields; no valid credentials are required.
What access does successful exploitation provide?
The server returns a fully authenticated session. An attacker can then issue privileged commands, including commanding connected drones and uploading flight routes.
What can be done if upgrading is not immediately possible?
Restrict network access to TCP port 3334 so untrusted systems cannot reach the HCI service. Adding more than one user avoids the described exactly-one-user condition, although access restriction remains important because the service is exposed on all interfaces without TLS by default.