Vulnerability Details : CVE-2023-29156

DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information. This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.
Published 2023-07-11 09:15:10
Updated 2023-07-20 02:11:22
Source Nozomi Networks Inc.
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-29156

EPSS FAQ
0.05%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 20 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-29156

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.8
 MEDIUM CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
1.6
5.2
 NIST
4.7
 MEDIUM CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
1.6
2.7
 Nozomi Networks Inc.

CWE ids for CVE-2023-29156

  • The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
    Assigned by: prodsec@nozominetworks.com (Secondary)

References for CVE-2023-29156

Products affected by CVE-2023-29156

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close