CVE-2023-31191

METADATA

VENDOR_NAME: UNKNOWN AFFECTED_VERSION: 20211210-1627 - 20230329-1042 MITRE_TACTIC: T1498 — Network Denial of Service SHODAN_DORKS: ["DroneScout ds230", "Remote ID receiver", "BlueMark Innovations ODID"] CWE_ID: N/A CVSS_VECTOR: N/A POC_STATUS: None PATCH_DETAILS: No patch available

Executive Summary

CVE-2023-31191 is an information loss vulnerability in the DroneScout ds230 Remote ID receiver from BlueMark Innovations that allows an attacker to inject high-power spoofed Open Drone ID messages on selected channels. The flaw resides in the adjacent channel suppression algorithm present in firmware versions 20211210-1627 through 20230329-1042. Successful exploitation causes the receiver to drop legitimate Remote ID data and emit crafted JSON-encoded MQTT messages, depriving the MQTT broker of accurate drone identification information and resulting in denial of service for downstream systems.

Technical Analysis

The vulnerability is an information-loss condition triggered by traffic injection against the adjacent channel suppression algorithm. When high-power spoofed Open Drone ID (ODID) messages are injected on carefully chosen channels, the receiver discards genuine Remote ID transmissions and substitutes crafted RID values inside JSON MQTT messages. No function names, classes, or code paths are disclosed in the NVD description; the mechanism is therefore described at the vulnerability-class level as selective suppression failure under targeted RF injection. The attack surface is the wireless interface of the ds230 receiver operating in the 2.4 GHz band used by ODID.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.

1. Reconnaissance/target identification: locate DroneScout ds230 receivers via RF survey or Shodan-style queries for exposed MQTT brokers ingesting RID data.
2. The specific flaw class is triggered by transmitting high-power spoofed ODID messages on channels adjacent to legitimate drone transmissions.
3. Payload/execution method at the vulnerability-class level: repeated injection of crafted Open Drone ID frames that exploit the adjacent channel suppression algorithm, forcing the receiver to drop real RID packets.
4. Post-exploitation impact: the MQTT broker receives only attacker-controlled JSON RID records, resulting in loss of real drone identification data for the system integrator.

Impact Assessment

CVSS score 9.3 indicates critical severity driven by high impact on availability and integrity of RID information. Affected systems include any deployment of the ds230 receiver feeding an MQTT broker operated by system integrators. Blast radius encompasses loss of drone tracking fidelity, potential regulatory non-compliance for Remote ID mandates, and downstream disruption of airspace monitoring platforms. No subscore vector is provided, but the described outcome matches a high-availability-impact denial-of-service condition.

Detection Guidance

Sigma Rule

title: DroneScout ds230 RID MQTT Anomaly
status: experimental
logsource:
  product: mqtt
  service: broker
detection:
  selection:
    topic: "/rid/"
    payload|contains: " crafted"
  condition: selection
fields:
  - src_ip
  - payload

YARA Rule

rule DroneScout_RID_MQTT_Crafted {
    strings:
        $mqtt = "MQTT"
        $rid  = "RemoteID"
        $json = "\"id\":" 
    condition:
        all of them and filesize < 10KB
}

Suricata IDS Rule

alert mqtt any any -> any any (msg:"DroneScout ds230 crafted RID injection"; content:"RemoteID"; content:"|22id|22"; sid:202331191; rev:1;)

Elastic Detection

sequence by broker.host
  [mqtt.message where topic like "/rid/*" and payload like "*crafted*"]

Splunk SPL Query

index=mqtt topic="/rid/*" payload="*crafted*" 
| stats count by src_ip, payload

Wazuh OSSEC Rule

<rule id="291161" level="12">
  <decoded_as>mqtt</decoded_as>
  <match>RemoteID.*crafted</match>
  <description>DroneScout ds230 RID information loss detected</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: reduce receiver RF gain on monitored channels, implement MQTT message validation at the broker to reject unexpected RID values, and monitor for sudden drops in legitimate drone count.
2. Patch/upgrade steps: none available; monitor vendor advisories for future firmware releases beyond 20230329-1042.
3. Long-term hardening: deploy redundant receivers on non-overlapping channels, enforce cryptographic authentication of ODID messages where supported, and segment MQTT topics to limit blast radius.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2023-31191
• CNA Title: Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations
• No CISA KEV entry recorded.
• No public exploit or threat actor campaign evidence identified.