CVE-2026-59104 · Other
NO FIX YET · SEE WHAT TO DO
UgCS server before 6.2 accepts a login request with empty username and password when the user database holds exactly one user, and returns a fully authenticated session. An attacker reaching TCP port 3334 can then issue privileged commands, including commanding connected drones and uploading flight routes.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running the UgCS drone ground-control server before 6.2, especially the default single-operator installation where the service listens on all interfaces without TLS. Systems where port 3334 is blocked from untrusted networks or where the server is already at 6.2 or later are not exposed to this network path.
Not affected if multi-user-database, port-3334-filtered, version-6.2-or-later
Who cares drones, self-hosted, ugcs
6.2.3334 is reachable from networks other than the operator's own machines, since the service listens on all interfaces by default.6.2 or later.UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as "use the only user" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.