CVE-2023-31190
📋 TL;DR
The DroneScout ds230 Remote ID receiver has an improper authentication vulnerability during firmware updates where it doesn't validate TLS certificates. This allows man-in-the-middle attackers to deliver malicious firmware and gain root access. Affects DroneScout ds230 devices running firmware versions 20211210-1627 through 20230329-1042.
💻 Affected Systems
- BlueMark Innovations DroneScout ds230 Remote ID receiver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains complete root control of the device, can install persistent backdoors, intercept drone communications, or use the device as a pivot point into connected networks.
Likely Case
Attacker with network access can deliver malicious firmware to compromise the device, potentially gaining control over drone tracking and identification functions.
If Mitigated
With proper network segmentation and certificate validation, the attack requires physical access or compromise of internal network infrastructure.
🎯 Exploit Status
Exploitation requires man-in-the-middle position but no authentication. The technique is well-known and could be weaponized by sophisticated attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 20230329-1042
Vendor Advisory: https://download.bluemark.io/dronescout/firmware/history.txt
Restart Required: Yes
Instructions:
1. Download latest firmware from BlueMark's official site. 2. Follow device-specific firmware update procedure. 3. Verify successful update and certificate validation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate DroneScout devices on separate VLANs to limit MITM attack surface
Disable Automatic Updates
allManually control firmware updates to prevent automatic downloads from vulnerable endpoints
🧯 If You Can't Patch
- Segment network to isolate DroneScout devices from untrusted networks
- Monitor for unusual firmware update attempts or network traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device web interface or SSH. If version is between 20211210-1627 and 20230329-1042, device is vulnerable.Check Version:
ssh admin@device-ip 'cat /etc/version' or check web interfaceVerify Fix Applied:
After update, verify firmware version is newer than 20230329-1042 and test that invalid TLS certificates are rejected during update attempts.📡 Detection & Monitoring
Log Indicators:
- Unexpected firmware update attempts
- Failed certificate validation logs
- Unusual file system modifications
Network Indicators:
- HTTPS traffic to non-BlueMark update servers
- Unusual TLS certificate patterns during firmware updates
SIEM Query:
source="dronescout" AND (event="firmware_update" OR event="certificate_validation")