Security Resilience

CVE-2023-31191

Bluemark Dronescout Ds230 Firmware 20211210-1627 – 20230329-1042

Published
11 July 2023
Modified
21 November 2024
CVSS Score v3.1 9.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
EPSS Score 0.0035 27th percentile
Risk Priority 65 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-31191 is a critical-severity Omission of Security-relevant Information (CWE-223) vulnerability in Bluemark Dronescout Ds230 Firmware. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Cached Domain Credentials (T1003.005); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A09:2025 Security Logging and Alerting Failures

EU & UK References

Vulnerability Data

DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, on carefully selected channels, high power spoofed Open Drone ID (ODID) messages which force…

more

the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information. This issue affects the adjacent channel suppression algorithm present in DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042.

CWE(s)
CWE-223NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
T1003.006 DCSync Credential Access
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…
attack.mitre.org →
T1016.001 Internet Connection Discovery Discovery
Adversaries may check for Internet connectivity on compromised systems.
attack.mitre.org →
T1016.002 Wi-Fi Discovery Discovery
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
attack.mitre.org →
T1027.001 Binary Padding Stealth
Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
attack.mitre.org →
T1027.006 HTML Smuggling Stealth
Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-29156Same product: Bluemark Dronescout Ds230
CVE-2023-31190Same product: Bluemark Dronescout Ds230
CVE-2023-28360Shared CWE-223
CVE-2024-52813Shared CWE-223
CVE-2025-52926Shared CWE-223
CVE-2026-31890Shared CWE-223

Affected Assets

bluemark
dronescout ds230 firmware
20211210-1627 — 20230329-1042

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.AE-02 mostly match
degrades

CWE-223 omits exactly the security details that DE.AE-02's log analysis and SIEM monitoring rely on, largely blinding the outcome while still leaving non-omitted data usable.

DE.AE-04 mostly match
degrades

CWE-223's omission of attack-relevant details largely blinds impact/scope estimation (DE.AE-04), removing most of its efficacy while not quite defeating every possible manual or external-data workaround.

DE.AE-06 mostly match
degrades

CWE-223 directly omits the security-relevant data that DE.AE-06 must deliver, largely defeating the outcome's purpose while not always eliminating every possible channel.

DE.AE-07 mostly match
degrades

CWE-223 omits the raw security data that DE.AE-07 must integrate with CTI, largely starving the analysis outcome in both directions.

DE.AE-08 mostly match
degrades

Missing security-relevant data largely blinds the criteria-based incident declaration process, removing most of its efficacy without making it completely impossible.

DE.CM-06 mostly match
degrades

CWE-223 omission directly blinds DE.CM-06 monitoring of external-provider activity by withholding the very security-relevant data needed to detect adverse events, impairing most (but not all) of the outcome's scope.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.28 Collection of evidence partial match
degrades

Evidence collection depends on logs and records that the weakness fails to produce.

A.8.15 Logging partial match
blocks

Logging directly requires recording security-relevant events that the weakness omits.

A.8.16 Monitoring activities partial match
finds

Monitoring activities rely on the very information whose absence defines the weakness.

A.8.19 Installation of software on operational systems partial match
removes
A.8.26 Application security requirements partial match
removes
A.8.27 Secure system architecture and engineering principles partial match
removes

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Ubuntu 22.04 (2 rules)
  • V-260591 Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time. blocks CWE-223
  • V-260590 Ubuntu 22.04 LTS must have the "auditd" package installed. blocks CWE-223
Ubuntu 24.04 (2 rules)
  • V-270656 Ubuntu 24.04 LTS must have the "auditd" package installed. blocks CWE-223
  • V-270657 Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time. blocks CWE-223

References