Auth bypass in Sph Engineering Ugcs
CVE-2026-59104
UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only user\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes.
Vulnerability class: Broken Authentication
Published .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (51.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 51.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
Weakness classification (CWE)
References
- a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (third-party-advisory)
- a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (product)
Frequently asked questions
- What is CVE-2026-59104?
- CVE-2026-59104 is a critical-severity vulnerability in Sph Engineering Ugcs, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-11-06.
- How severe is CVE-2026-59104?
- Critical severity. CVSS v3 base score is 9.8 out of 10.