CVE-2023-29156
Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.
This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.
This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.
- Record
CVE-2023-29156- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-223
- Updated
- 2026-11-02
EUVDEUVD-2023-32758
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.
This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.
- Record
EUVD-2023-32758- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pggp-wpfc-2w3c
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss...
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.
This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.
- Record
GHSA-pggp-wpfc-2w3c- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-221, CWE-223
- Updated
- 2026-11-02
NVD
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.
This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.
- Record
CVE-2023-29156- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-223
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-29156 is a medium vulnerability (CVSS 4.7) in Bluemark Ds230, published July 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. No source names a fixed version.