UgCS server versions before 6.2 have an authentication bypass vulnerability in the HCI protocol login handler on TCP port 3334. If the user database contains exactly one user, a login request with empty credentials is accepted as that user, granting a fully authenticated session. The service listens on all interfaces without TLS by default, allowing unauthenticated remote attackers with network access to port 3334 to gain privileged access, including commanding drones and uploading flight routes.