CVE-2026-59104

Summary

The UgCS server before 6.2 has an authentication bypass in its HCI protocol login handler on TCP port 3334: when only one user exists (default setup), empty credentials are accepted as valid, granting full authenticated access without knowing any password.

Exploitability

Trivial to exploit remotely; requires only network access to port 3334 and sending a LoginRequest with empty userLogin and userPassword fields.

Blast radius

An attacker can fully compromise the system: issue privileged commands, command connected drones, and upload malicious flight routes, leading to potential physical safety risks and data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to UgCS server version 6.2 or later, which fixes the authentication bypass.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.