UgCS server login bypass with empty credentials
A drone control server lets anyone in without a password and command drones!
Summary
A flaw in the login handling of the UgCS drone ground-control server lets an unauthenticated remote attacker connect without any credential. Versions before 6.2 are affected, and a connected attacker can issue privileged commands such as commanding drones and uploading flight routes.
Affected when
- Single user account in the database (default single-operator install)
- TCP port 3334 reachable from the network (listens on all interfaces by default)
What to do
Update to UgCS 6.2 or later. If you cannot yet, bind the HCI listener to 127.0.0.1 and firewall TCP port 3334 so only hosts that need it can reach it.
Products and platforms
CVE IDs
Sources
- Write-up: offseq.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen