Authentication bypass with empty credentials in the UgCS drone ground-control server

§ 01. Overview

UgCS is drone ground-control software from SPH Engineering, used to plan and fly missions and to command unmanned aircraft. Its server exposes an HCI (host-computer integration) protocol on TCP port 3334 so that other software can log in and drive the platform – read state, issue commands, and upload flight routes.

OffSeq found that the HCI login handler lets a client authenticate with no credentials at all. When the user database contains exactly one account – the default for a single-operator installation – a login request with empty login and password fields is resolved to that one user and the session is fully authenticated. Because the listener binds to every interface without TLS by default, this turns a local convenience into a remote authentication bypass that any host on the network can use. It is tracked as CVE-2026-59104, coordinated by CERT.LV.

§ 02. Empty credentials as a login

The HCI LoginHandler accepts a LoginRequest carrying a client identifier, a user login and a user password. When the login and password fields are absent, the handler does not reject the request as invalid. Instead, if the user database holds exactly one user, it resolves the empty credentials to that single account and returns a LoginResponse for a fully authenticated session.

That session is not degraded or read-only. It carries the privileges of the resolved operator, so from it a client can issue the platform's privileged commands – including those that command connected drones and upload or modify flight routes.

§ 03. Root cause: a local convenience exposed to the network

The behaviour is a convenience path. On a local, single-operator machine, letting the operator connect without retyping credentials is a usability choice, and "the only user" is an unambiguous target. The flaw is that the same service is network-exposed by default: it binds to 0.0.0.0 – every interface – and runs without TLS. The assumption that the only client is the local operator does not hold once the port is reachable from other hosts, and the convenience becomes an unauthenticated bypass. This is why it is classed as improper authentication (CWE-287) via an authentication-bypass primary weakness (CWE-305), not a credential-strength problem: no credential is involved at all.

§ 04. The HCI wire format

The finding was confirmed by speaking the HCI protocol directly. Each message is a 16-byte big-endian header followed by a protobuf body:

The relevant message types are LoginRequest (22), LoginResponse (23), AuthorizeHciRequest (20) and Error (0). A LoginRequest carries clientId (field 1), userLogin (field 2) and userPassword (field 3). Protobuf does not serialise absent fields, so a request that simply omits userLogin and userPassword reaches the handler with those fields empty – and, against a single-user database, is answered with a LoginResponse rather than an Error.

All testing was carried out in a controlled environment against systems OffSeq controls; no third-party systems were touched.

§ 05. Impact and severity

The published metrics are CVSS 3.1 base 9.8 (Critical) (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 base 9.3 (Critical) (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The vector is network-reachable, low-complexity, with no privileges and no user interaction: the default one-operator install is the vulnerable state, the default bind is 0.0.0.0 without TLS, and no credential is needed. A successful login grants full privileged control of the session – reading state, issuing commands, and uploading or modifying flight routes – each of confidentiality, integrity and availability rated High.

§ 06. Remediation

SPH Engineering fixed the issue in UgCS 6.2: empty credentials are no longer accepted as a valid login. Operators should upgrade to UgCS 6.2 or later.

For deployments that cannot upgrade immediately, reduce exposure in depth: bind the HCI listener to 127.0.0.1 rather than every interface, restrict TCP port 3334 with host and network firewall rules so only the hosts that need it can reach the service, and place it behind an authenticated TLS transport.

§ 07. Disclosure and outcome

The vulnerability was reported to CERT.LV through Latvia's national coordinated-vulnerability-disclosure platform on 30 June 2026, triaged and forwarded to the vendor on 6 July. It was confirmed and CVE-2026-59104 reserved on 6 August 2026. The vendor reported the fix complete on 8 October and released it in UgCS 6.2 on 9 October 2026. The disclosure is coordinated by CERT.LV.

The discovery is credited to Nils Putniņš (OffSeq Cybersecurity).