CVE-2026-59104 in UgCS
Summary
by MITRE • 11/06/2026
UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only user\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The UgCS server software prior to version 6.2 contains a critical authentication bypass vulnerability within its Human-Computer Interface protocol login handler, specifically affecting the LoginHandler component exposed on TCP port 3334. This flaw arises from an insecure default configuration and logic error in how the server validates credentials when operating with a single-user database. In typical deployments where only one operator account exists, which is common for standard installations intended for individual drone operators or small teams, the authentication mechanism fails to enforce strict credential validation. Instead of rejecting requests that lack valid identifiers, the system interprets an empty userLogin and userPassword field as an implicit instruction to utilize the sole existing user account. This behavior allows any entity capable of reaching port 3334 over a network connection to bypass authentication entirely by sending a LoginRequest with blank fields, thereby obtaining a fully authenticated session without possessing valid credentials.
The operational impact of this vulnerability is severe due to both the nature of the access gained and the default network configuration of the service. The UgCS server listens on all available interfaces, bound to 0.0.0.0 by default, which exposes it to any network segment that can route traffic to port 3334 unless explicitly restricted by firewall rules or network segmentation. Furthermore, the communication channel lacks Transport Layer Security encryption in its default state, meaning credentials and session tokens are transmitted in plaintext if they were ever used correctly, but more critically here, the lack of authentication means no security boundary exists at all for remote attackers with basic network connectivity. An unauthenticated attacker can exploit this flaw to gain full administrative control over the ground station software. This includes the ability to issue privileged commands that directly impact physical assets, such as commanding connected drones to move, change altitude, or execute other flight maneuvers, and uploading new flight routes. Such capabilities pose a significant risk of unauthorized surveillance, data theft via drone-mounted sensors, property damage through reckless piloting, or using the compromised system as a pivot point for further network intrusion.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, where an attacker is able to bypass authentication mechanisms by exploiting logic flaws in credential validation. The specific behavior of treating empty credentials as valid for a single-user setup represents a failure to enforce minimum security requirements during the login process. Additionally, because the service listens on all interfaces without encryption and allows remote exploitation over standard network protocols, it also relates to CWE-319 Cleartext Transmission of Sensitive Information if any subsequent authenticated traffic is monitored, although the primary issue remains the authentication bypass itself. In terms of adversary tactics, this vulnerability facilitates initial access through ATT&CK technique T1078 Valid Accounts, as attackers can establish legitimate-looking sessions using stolen or forged credentials derived from the system state without needing to crack passwords. It also enables privilege escalation and command execution via T1059 Command and Scripting Interpreter if the drone control interface allows script-like commands, and potentially lateral movement within a connected network environment.
Mitigation strategies must address both the software version and the deployment configuration immediately. The primary remediation is to upgrade the UgCS server to version 6.2 or later, where this logic flaw in the LoginHandler has been corrected to properly reject empty credentials regardless of database size. Until an upgrade can be performed, administrators should implement strict network-level controls by configuring firewalls to restrict access to TCP port 3334 exclusively to trusted IP addresses or internal subnets that require legitimate interaction with the ground station. Enabling TLS encryption for the HCI protocol is also recommended if supported in newer versions or via reverse proxy configurations, although this does not mitigate the authentication bypass itself; it only protects data integrity and confidentiality once a session is established. Additionally, organizations should review their drone security policies to ensure that physical access controls are robust enough to prevent unauthorized individuals from connecting devices directly to local networks hosting these systems. Regular vulnerability assessments and penetration testing focused on ground control station interfaces can help identify similar misconfigurations in other IoT or industrial control environments before they are exploited by malicious actors seeking to compromise unmanned aerial vehicle operations.