{"id":"CVE-2026-59104","published":"2026-11-06T22:17:59.043","lastModified":"2026-11-10T15:17:28.490","description":"UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \\\"use the only user\\\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://offseq.com/en/research/ugcs-cve-2026-59104/","tags":[]},{"url":"https://www.ugcs.com/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The UgCS server before 6.2 has an authentication bypass in its HCI protocol login handler on TCP port 3334: when only one user exists (default setup), empty credentials are accepted as valid, granting full authenticated access without knowing any password.","exploitability":"Trivial to exploit remotely; requires only network access to port 3334 and sending a LoginRequest with empty userLogin and userPassword fields.","blast_radius":"An attacker can fully compromise the system: issue privileged commands, command connected drones, and upload malicious flight routes, leading to potential physical safety risks and data exfiltration.","remediation":"Upgrade to UgCS server version 6.2 or later, which fixes the authentication bypass.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","hci-protocol","drone-control","ics","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:55:12.849Z"}}