{"id":"CVE-2026-59104","kind":"vulnerability","aliases":["CVE-2026-59104"],"related":[],"title":"UgCS server: empty login on port 3334 grants authenticated session","description":"UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \\\"use the only user\\\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.","summary":"UgCS server before 6.2 accepts a login request with empty username and password when the user database holds exactly one user, and returns a fully authenticated session. An attacker reaching TCP port 3334 can then issue privileged commands, including commanding connected drones and uploading flight routes.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drones","other","self-hosted","ugcs"],"not_affected_if":["multi-user-database","port-3334-filtered","version-6.2-or-later"],"how_to_check":"- Check the UgCS server version and confirm it is below `6.2`.\n- Check whether TCP port `3334` is reachable from networks other than the operator's own machines, since the service listens on all interfaces by default.\n- Check whether the user database contains exactly one user, the default single-operator setup.","fix":"- UgCS server: move to `6.2` or later.","status":"open","published_at":"2026-11-06T22:17:59+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","triaged_at":"2026-11-06T22:44:43+00:00","updated_at":"2026-11-06T22:44:43+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-06T22:44:43Z","model":"claude-haiku-5-5","output":{"fix":"- UgCS server: move to `6.2` or later.","reach":"network","title":"UgCS server: empty login on port 3334 grants authenticated session","impact":"high","summary":"UgCS server before 6.2 accepts a login request with empty username and password when the user database holds exactly one user, and returns a fully authenticated session. An attacker reaching TCP port 3334 can then issue privileged commands, including commanding connected drones and uploading flight routes.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ugcs","drones","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attacker commands drones and uploads flight routes remotely","analyst_note":"Confirm the fixed version and any interim mitigation from the vendor advisory; the sources give only the NVD record.","how_to_check":"- Check the UgCS server version and confirm it is below `6.2`.\n- Check whether TCP port `3334` is reachable from networks other than the operator's own machines, since the service listens on all interfaces by default.\n- Check whether the user database contains exactly one user, the default single-operator setup.","plain_action":"","needs_analyst":true,"not_affected_if":["version-6.2-or-later","port-3334-filtered","multi-user-database"],"who_is_affected":"Teams running the UgCS drone ground-control server before 6.2, especially the default single-operator installation where the service listens on all interfaces without TLS. Systems where port 3334 is blocked from untrusted networks or where the server is already at 6.2 or later are not exposed to this network path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000734,"input_tokens":4357,"output_tokens":596,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-59104':13A,16A '0.0.0.0':138C '3334':7A,55B,88C,152C '6.2':26B,72C 'accept':27B 'access':149C 'attack':51B,146C 'authent':9A,48B,75C,129C,156C 'bypass':76C 'command':60B,62B,166C,168C 'connect':63B,169C 'contain':73C,93C 'credenti':122C,161C 'cve':11A,14A 'databas':39B,92C 'default':98C,142C 'drone':17B,64B,170C 'empti':3A,32B,106C 'exact':41B,94C 'expos':84C 'field':110C 'flight':67B,173C 'fulli':47B,128C 'grant':8A 'handler':82C 'hci':79C 'hold':40B 'host':21B 'includ':61B,167C 'instal':102C 'interfac':137C 'interpret':112C 'invalid':121C 'issu':58B,164C 'know':159C 'listen':134C 'login':4A,29B,81C 'loginhandl':83C 'loginrequest':104C 'network':148C 'obtain':154C 'one':42B,95C 'oper':101C 'password':35B 'port':6A,54B,87C,151C 'privileg':59B,165C 'protocol':80C 'rather':118C 'reach':52B 'remot':145C 'request':30B 'return':45B,126C 'rout':68B,174C 'self':20B 'self-host':19B 'server':2A,24B,70C,125C 'servic':133C 'session':10A,49B,130C,157C 'singl':100C 'single-oper':99C 'tcp':53B,86C 'tls':140C 'ugc':1A,22B,23B,69C 'unauthent':144C 'upload':66B,172C 'use':114C 'user':38B,43B,91C,96C,117C 'userlogin':107C 'usernam':33B 'userpassword':109C 'without':139C,158C","nicknames":[],"mitigations":[],"who_affected":"Teams running the UgCS drone ground-control server before 6.2, especially the default single-operator installation where the service listens on all interfaces without TLS. Systems where port 3334 is blocked from untrusted networks or where the server is already at 6.2 or later are not exposed to this network path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","drones","other","selfhosted","ugcs"],"campaign_type":null,"search_a":"'-2026':12A,15A '-59104':13A,16A '3334':7A 'authent':9A 'cve':11A,14A 'empti':3A 'grant':8A 'login':4A 'port':6A 'server':2A 'session':10A 'ugc':1A","search_b":"'3334':55B '6.2':26B 'accept':27B 'attack':51B 'authent':48B 'command':60B,62B 'connect':63B 'databas':39B 'drone':17B,64B 'empti':32B 'exact':41B 'flight':67B 'fulli':47B 'hold':40B 'host':21B 'includ':61B 'issu':58B 'login':29B 'one':42B 'password':35B 'port':54B 'privileg':59B 'reach':52B 'request':30B 'return':45B 'rout':68B 'self':20B 'self-host':19B 'server':24B 'session':49B 'tcp':53B 'ugc':22B,23B 'upload':66B 'user':38B,43B 'usernam':33B","search_c":"'0.0.0.0':138C '3334':88C,152C '6.2':72C 'access':149C 'attack':146C 'authent':75C,129C,156C 'bypass':76C 'command':166C,168C 'connect':169C 'contain':73C,93C 'credenti':122C,161C 'databas':92C 'default':98C,142C 'drone':170C 'empti':106C 'exact':94C 'expos':84C 'field':110C 'flight':173C 'fulli':128C 'handler':82C 'hci':79C 'includ':167C 'instal':102C 'interfac':137C 'interpret':112C 'invalid':121C 'issu':164C 'know':159C 'listen':134C 'login':81C 'loginhandl':83C 'loginrequest':104C 'network':148C 'obtain':154C 'one':95C 'oper':101C 'port':87C,151C 'privileg':165C 'protocol':80C 'rather':118C 'remot':145C 'return':126C 'rout':174C 'server':70C,125C 'servic':133C 'session':130C,157C 'singl':100C 'single-oper':99C 'tcp':86C 'tls':140C 'ugc':69C 'unauthent':144C 'upload':172C 'use':114C 'user':91C,96C,117C 'userlogin':107C 'userpassword':109C 'without':139C,158C","first_public_at":"2026-11-06T22:17:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59104","severity":null,"published_at":"2026-11-06T22:17:59+00:00","modified_at":"2026-11-06T22:17:59+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","fetched_at":"2026-11-06T22:44:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}