CVE-2026-59104

Name of the Vulnerable Software and Affected Versions UgCS server versions prior to 6.2

Description An authentication bypass exists in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. In installations where the user database contains only one user, a LoginRequest containing empty userLogin and userPassword fields is incorrectly processed as a request to use the single existing user instead of being rejected as invalid. This allows a remote attacker to obtain a fully authenticated session without credentials. Since the service listens on all interfaces (0.0.0.0) without TLS by default, an attacker with network access to port 3334 can issue privileged commands, such as controlling connected drones and uploading flight routes.

Recommendations Update to version 6.2.