Log in / Sign up

Vulnerability details

CVE-2026-59104

SPH Engineering UgCS

UgCS server HCI authentication bypass with empty credentials

CVSS 4.0
9.3Critical

Official description

UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only user\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.

CVSS scores

ScoreVersionSourceVector
9.3Critical 4.0 CVEProject cvelistV5 (CNA) (ENISA) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
9.8Critical 3.1 CVEProject cvelistV5 (CNA) (ENISA) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
SPH Engineering UgCS v < 6.2 CVEProject cvelistV5 (CNA)

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-11-07
Last updated
2026-11-07
State
Published
Assigner (CNA)
ENISA
Kolun priority
27 · Low

Exploit prediction (EPSS)

0.65%
Probability of exploitation in 30 days
51.7%
Percentile (among all CVEs)

Weaknesses (CWE)

  • CWE-287
    Improper Authentication