CVE-2023-31190

Summary

CVE-2023-31190: DroneScout ds230 Remote ID receiver from BlueMark Innovations is susceptible to an Improper Authentication vulnerability during the firmware update procedure. This weakness allows an attacker to install malicious firmware updates, bypassing the check on the TLS certificate of the HTTPS endpoint. An adversary can gain administrative (root) privileges on the underlying Linux operating system if they manipulate the update process through Man-in-the-Middle techniques like DNS or ARP poisoning. The DroneScout ds230 firmware versions from 20211210-1627 to 20230329-1042 are affected.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.