Description

UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only user\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T22:17:59.043Z",
  "pubdate": "2026-11-06T22:17:59.043Z",
  "executiveSummary": "UgCS server versions prior to 6.2 are susceptible to an authentication bypass vulnerability residing in the HCI protocol login handler. The flaw is triggered when the system is configured with a single user, allowing an unauthenticated remote attacker to gain full administrative access without providing valid credentials.\nThe vulnerability stems from improper input validation within the login logic, where empty login fields are incorrectly treated as a request to authenticate as the default operator. Because the affected service listens on all network interfaces (0.0.0.0) without mandatory TLS encryption, it is highly susceptible to exploitation by any remote entity with network visibility to TCP port 3334.\nThe impact is critical, as successful exploitation grants the attacker complete control over the UgCS server, enabling them to issue privileged commands, manipulate connected drones, and modify flight route data. This poses significant physical and operational risks. There are no authentication or authorization prerequisites for an attacker, making this a zero-click, unauthenticated remote code execution-equivalent vulnerability for the application's control plane.",
  "technicalDetails": "The vulnerability is located in the LoginHandler component of the UgCS HCI protocol, which facilitates communication on TCP port 3334. The root cause is a flaw in the session initialization logic that processes LoginRequest packets. In installations containing a single user record, the application logic fails to validate the presence of provided credentials. Instead, an empty userLogin and userPassword payload is processed by the server as an implicit authorization request for the existing account.\nThe attack flow begins with an unauthenticated remote actor establishing a TCP connection to the UgCS server on port 3334. The attacker transmits a crafted LoginRequest message containing empty strings for the identity and credential fields. The LoginHandler receives this request, identifies that only one user exists in the local database, and erroneously grants an authenticated session token. Because the service does not enforce TLS by default, the communication occurs in plaintext, allowing for easy observation and packet construction without complex encryption handling.\nOnce the session token is returned to the attacker, the server effectively treats the attacker as the authenticated system operator. With this session established, the attacker can leverage the full command set of the HCI protocol. This includes, but is not limited to, the ability to command connected Unmanned Aerial Vehicles (UAVs), modify mission parameters, retrieve sensitive flight logs, and upload malicious flight routes. The lack of secondary authentication or command-level authorization ensures that the attacker's actions are performed with full administrative privileges.\nThe vulnerability is restricted to environments where the server is configured with exactly one user, which is the default state for many standard installations. The exposure is exacerbated by the service binding to all available network interfaces (0.0.0.0), exposing the administrative protocol to any reachable network segment rather than restricting it to a secure management network or localhost. This implementation failure effectively circumvents the authentication barrier intended to protect the UAV command-and-control functionality."
}