External risk intelligence

UgCS Server Authentication Bypass via HCI Protocol

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-59104

The vulnerability exists in a specific server application (UgCS) listening on TCP port 3334. While it defaults to binding to all interfaces and is network-reachable, it is a specialized industrial/drone management service. It is not typically exposed directly to the public internet as a general-purpose web service, making internet-facing exposure possible but not a standard deployment pattern.

Authentication Bypass

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the UgCS server software that could allow an unauthenticated remote attacker to bypass login controls. If the server is configured with a single user, an attacker could exploit this by sending empty credentials to gain full administrative access, enabling them to command connected drones and manipulate flight routes. The main concern is confirming the relevance and exposure of this specific application within our environment.

Authentication bypass allows unauthorized drone control.
Critical flaw impacts specialized drone management software.
Verify if UgCS is deployed and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with network access to the UgCS server's management port can bypass authentication if the server is configured with a single user. This allows them to gain full control over the system, including commanding connected drones and uploading flight plans. The vulnerability is present in the HCI protocol's login handler, which is exposed on TCP port 3334.

Network access to port 3334.
Login request with empty credentials.
Unauthorized administrative control.

Live Threat

Current exploitation, exposure, and threat context

A critical authentication bypass vulnerability exists in the UgCS server when configured with a single user, allowing unauthenticated remote attackers to gain full administrative access. This could enable unauthorized control over connected drones and the uploading of malicious flight routes.

System data and drone control at risk.
Network access to port 3334.
Unauthorized drone commands and route uploads.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the UgCS server's HCI protocol login handler, exposed on TCP port 3334, allows unauthenticated remote attackers to gain full administrative access on default single-user installations. Owners of UgCS deployments should first identify all instances of the affected server, confirm network reachability to port 3334, and then engage with the application or infrastructure teams responsible for drone management systems to plan remediation.

UgCS application owners or drone system administrators.
Verify network exposure of TCP port 3334.
Plan remediation based on identified risk and asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is UgCS software?

UgCS is a specialized server application used for managing and controlling drone operations. It enables users to plan complex flight routes and issue commands to connected drones in real-time. The server acts as a central hub, communicating with these aircraft to support industrial, surveying, or professional drone missions.

How does this CVE-2026-59104 vulnerability work?

This issue is an authentication bypass, categorized as Improper Authentication (CWE-287). The software's login handler incorrectly processes empty credentials when only one user is registered. Instead of rejecting the empty login, the system automatically logs the attacker in, granting them a fully authenticated session without any valid password.

When is the UgCS server vulnerable to this bypass?

The server is susceptible if it is configured with exactly one user account. The vulnerability does not trigger if there are multiple users configured, as the system would then require specific credentials. The exploit requires network connectivity to TCP port 3334, where the HCI protocol listens for incoming login requests.

Do I need to worry if my UgCS server is on an internal network?

Yes. Halo Surface Signal identifies that while UgCS is a specialized service not typically exposed to the public internet, it listens on all network interfaces by default. Any device with network access to the server's TCP port 3334 can reach the interface. You should check if your internal network segmentation is sufficient to restrict access to authorized users only.

How should I respond to the UgCS authentication issue?

Start by identifying all UgCS server installations in your environment. Confirm whether these instances are running versions prior to 6.2 and verify if they are configured with only a single user. Work with your drone operations or infrastructure teams to restrict network access to port 3334 and plan for authorized updates to secure the login handler.

References

offseq.com/en/research/ugcs-cve-2026-59104/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.