CVE-2023-31191

CVSS V2 None CVSS V3 None

Description

DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, on carefully selected channels, high power spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information. This issue affects the adjacent channel suppression algorithm present in DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042.

Overview

CVE ID
CVE-2023-31191

Assigner
Nozomi

Vulnerability Status
PUBLISHED

Published Version
2023-07-11T08:45:14.541Z

Last Modified Date
2023-07-11T08:45:14.541Z

Weakness Enumerations

CWE	URL
CWE-221	http://cwe.mitre.org/data/definitions/221.html

References

Reference URL	Reference Tags
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-31191/
https://download.bluemark.io/dronescout/firmware/history.txt

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-31191
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31191

History

Created	Old Value	New Value	Data Type	Notes
2024-06-24 21:27:40				Added to TrackCVE