Nicolò Facchi

**Name of the Vulnerable Software and Affected Versions** DroneScout ds230 versions 20211210-1627 through 20230329-1042 **Description** The issue is an information loss vulnerability through traffic injection. An attacker can exploit this by injecting spoofed Open Drone ID (ODID) messages, forcing the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and transmit JSON encoded MQTT messages with crafted RID information instead. Consequently, the MQTT broker will have no access to the drones' real RID information. **Recommendations** For versions 20211210-1627 through 20230329-1042, as a temporary workaround, consider disabling the reception of Open Drone ID (ODID) messages until a patch is available. Restrict access to the MQTT broker to minimize the risk of exploitation. Avoid using the affected firmware versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DroneScout ds230 firmware versions 20211210-1627 through 20230329-1042 **Description** The DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication issue during the firmware update procedure. Specifically, the firmware update procedure ignores and does not check the validity of the TLS certificate of the HTTPS endpoint from which the firmware update package (.tar.bz2 file) is downloaded. An attacker with the ability to put himself in a Man-in-the-Middle situation can trick the DroneScout ds230 to install a crafted malicious firmware update containing arbitrary files and gain administrative privileges on the underlying Linux operating system. **Recommendations** For DroneScout ds230 firmware versions 20211210-1627 through 20230329-1042, as a temporary workaround, consider restricting access to the firmware update procedure until a patch is available. Additionally, avoid using unsecured or untrusted networks for firmware updates to minimize the risk of Man-in-the-Middle attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** DroneScout ds230 Remote ID receiver from BlueMark Innovations versions 20211210-1627 through 20230329-1042 **Description** The issue is related to an information loss vulnerability through traffic injection. An attacker can exploit this by injecting high power spoofed Open Drone ID (ODID) messages on carefully selected channels, forcing the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information. Instead, it generates and transmits JSON encoded MQTT messages containing crafted RID information, resulting in the MQTT broker having no access to the drones' real RID information. This affects the adjacent channel suppression algorithm in the firmware. **Recommendations** For versions 20211210-1627 through 20230329-1042, consider disabling the adjacent channel suppression algorithm as a temporary workaround until a patch is available. Restrict access to the MQTT broker to minimize the risk of exploitation. Avoid using crafted RID information in JSON encoded MQTT messages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.