UgCS server versions prior to 6.2 are vulnerable due to a CWE-287 Authentication Bypass in the HCI protocol. When the internal database contains only the default operator, the login handler interprets an empty LoginRequest as a request to use the sole existing user, returning a fully authenticated session without credential verification. An attacker can then use this session to issue privileged commands, including controlling drones and uploading flight routes.

Affected deployments are UgCS installations from SPH Engineering with versions older than 6.2. The vulnerability relies on the server listening on TCP port 3334 on all network interfaces by default, making configurations that follow the default single‑operator installation without additional security controls exposed.

The CVSS score of 9.3 indicates critical severity. EPSS data is not available, but because the attacker only needs network connectivity to port 3334 and no authentication, the likelihood of exploitation is high. The vulnerability is not currently listed in CISA's KEV. An unauthenticated remote attacker could obtain a privileged session, giving full control over any connected drones and the ability to upload malicious flight plans.