Authentication bypass in UgCS server HCI login handler
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
SPH Engineering UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler on TCP port 3334. When the user database holds exactly one user, a login request with empty credentials is treated as a login for that user, and the server returns an authenticated session. An unauthenticated remote attacker with network access to the port can obtain a session without any credential and then issue privileged commands, including commanding connected drones and uploading flight routes. The flaw is classified as CWE-287.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only user\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SPH Engineering | UgCS | before 6.2 | 6.2 | Patch available | CNA |
- UgCS VendorSPH Engineering Affected before 6.2 Fixed in 6.2 Patch available CNA
Remediation
Update SPH Engineering UgCS to version 6.2 or later, which is the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA UgCS (SPH Engineering) Fixed in 6.2
Timeline
- 2026-11-06 Threatist record created from CVE-2026-59104
- 2026-11-07 Alias added: GHSA-8f29-c49m-pq4g
References
Sources
- CVE-2026-59104 · CVE Program
- CVE-2026-59104 · NVD
- FIRST EPSS
- GHSA-8f29-c49m-pq4g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences