Cyber Resilience

CVE-2023-29156

Bluemark Dronescout Ds230 Firmware 20211210-1627 – 20230329-1042

Published
11 July 2023
Modified
21 November 2024
CVSS Score v3.1 4.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
EPSS Score 0.0032 24th percentile
Risk Priority 37 floored blend · peak EPSS

Summary

CVE-2023-29156 is a medium-severity Omission of Security-relevant Information (CWE-223) vulnerability in Bluemark Dronescout Ds230 Firmware. Its CVSS base score is 4.7 (Medium).

Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A09:2025 Security Logging and Alerting Failures

EU & UK References

Vulnerability Data

DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout…

more

ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information. This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.

CWE(s)
CWE-223NVD-CWE-noinfo

Related Threats

CVEs Like This One

CVE-2023-31191Same product: Bluemark Dronescout Ds230
CVE-2023-31190Same product: Bluemark Dronescout Ds230
CVE-2024-52813Shared CWE-223
CVE-2025-52926Shared CWE-223
CVE-2023-28360Shared CWE-223
CVE-2026-31890Shared CWE-223

Affected Assets

bluemark
dronescout ds230 firmware
20211210-1627 — 20230329-1042

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.AE-02 mostly match
degrades

CWE-223 omits exactly the security details that DE.AE-02's log analysis and SIEM monitoring rely on, largely blinding the outcome while still leaving non-omitted data usable.

DE.AE-04 mostly match
degrades

CWE-223's omission of attack-relevant details largely blinds impact/scope estimation (DE.AE-04), removing most of its efficacy while not quite defeating every possible manual or external-data workaround.

DE.AE-06 mostly match
degrades

CWE-223 directly omits the security-relevant data that DE.AE-06 must deliver, largely defeating the outcome's purpose while not always eliminating every possible channel.

DE.AE-07 mostly match
degrades

CWE-223 omits the raw security data that DE.AE-07 must integrate with CTI, largely starving the analysis outcome in both directions.

DE.AE-08 mostly match
degrades

Missing security-relevant data largely blinds the criteria-based incident declaration process, removing most of its efficacy without making it completely impossible.

DE.CM-06 mostly match
degrades

CWE-223 omission directly blinds DE.CM-06 monitoring of external-provider activity by withholding the very security-relevant data needed to detect adverse events, impairing most (but not all) of the outcome's scope.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.15 Logging full match
prevents

Logging directly requires recording security-relevant events that the weakness omits.

A.5.28 Collection of evidence partial match
degrades

Evidence collection depends on logs and records that the weakness fails to produce.

A.8.16 Monitoring activities partial match
finds

Monitoring activities rely on the very information whose absence defines the weakness.

A.5.24 Information security incident management planning and preparation none match
none

Incident-management planning assumes the availability of the data the weakness fails to capture.

A.5.25 Assessment and decision on information security events none match
none

Event assessment requires the security-relevant details the weakness omits.

A.5.26 Response to information security incidents none match
none

Incident response effectiveness is reduced without the omitted information.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Ubuntu 22.04 (2 rules)
  • V-260591 Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time. prevents CWE-223
  • V-260590 Ubuntu 22.04 LTS must have the "auditd" package installed. prevents CWE-223
Ubuntu 24.04 (2 rules)
  • V-270656 Ubuntu 24.04 LTS must have the "auditd" package installed. prevents CWE-223
  • V-270657 Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time. prevents CWE-223

References