---
id: "CVE-2026-59104"
page: "https://infrastack.ai/live/CVE-2026-59104"
kind: "vulnerability"
aliases: ["CVE-2026-59104"]
title: "UgCS server: empty login on port 3334 grants authenticated session"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["drones", "other", "self-hosted", "ugcs"]
not_affected_if: ["multi-user-database", "port-3334-filtered", "version-6.2-or-later"]
published_at: "2026-11-06T22:17:59+00:00"
first_seen_at: "2026-11-06T22:44:32+00:00"
updated_at: "2026-11-06T22:44:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59104", "first_seen_at": "2026-11-06T22:44:32+00:00"}]
exploit_sources: []
---

# UgCS server: empty login on port 3334 grants authenticated session

Link for people: https://infrastack.ai/live/CVE-2026-59104 (this .md is for agents)

UgCS server before 6.2 accepts a login request with empty username and password when the user database holds exactly one user, and returns a fully authenticated session. An attacker reaching TCP port 3334 can then issue privileged commands, including commanding connected drones and uploading flight routes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the UgCS server version and confirm it is below `6.2`.
- Check whether TCP port `3334` is reachable from networks other than the operator's own machines, since the service listens on all interfaces by default.
- Check whether the user database contains exactly one user, the default single-operator setup.

## Fix

- UgCS server: move to `6.2` or later.

## Timeline

- 2026-11-06T22:44:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59104

## From the sources

UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only user\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_