CVE-2026-59104: UgCS authentication bypass critical

CVSS 9.8 critical. UgCS < 6.2: port 3334 authentication bypass, remote unauthenticated access. Update to 6.2.

CVE-2026-59104 is an authentication bypass in UgCS server before version 6.2. The flaw exists in the HCI protocol login handler on port 3334. Single-user installations (default configuration) interpret empty LoginRequest fields as 'use the only user', returning authenticated sessions without credentials. The service listens on 0.0.0.0 without TLS, exposing risk to any network interface.

Maximum severity: CVSS 9.8 (critical). An unauthenticated remote attacker gains authorized sessions and commands connected drones, uploading critical flight routes. Single-operator installations are immediately exposed. NVD confirmed 2026-11-06. Three active social media reports in 24 hours indicate visibility of the risk.

Update to UgCS 6.2+ immediately. Verify current version in server logs. If port 3334 is network-exposed, apply firewall segmentation restrictions urgently. Monitor authentication logs for empty sessions. If immediate update is impossible, isolate UgCS systems from public network until patch is deployed.

At a glance

What: UgCS server LoginHandler HCI protocol on port 3334: authentication bypass when user database contains exactly one user. Empty userLogin and userPassword fields interpreted as 'use only user' instead of invalid credentials.
Severity: CVSS 9.8 (critical). Unauthenticated remote attacker obtains fully authenticated session without credentials, enabling drone command and flight route upload.
Affected versions: UgCS server versions before 6.2. Single-operator installations (default configuration for single operators) at maximum risk.
Fix: Update UgCS server to version 6.2 or later. Consult official SPH Engineering patch notes for post-update verification.
Status: Vulnerability confirmed on NVD 2026-11-06. Actively reported on social media (3 posts in last 24 hours, 26 interactions). Public exploit status not reported.
Action: Verify UgCS version in environment. Audit network for port 3334 exposure. If single-operator system, critical update priority. Implement network segmentation and restrictive firewall rules before patching if possible.

Sources: NVD, CVE-2026-59104

← All articles