Security readout for executives and security teams
Plain-English summary
This flaw can make a DroneScout ds230 receiver lose real drone Remote ID data and report attacker-crafted drone identity data instead. For organizations relying on ds230 feeds for airspace awareness, incident response, or site security, the business risk is misleading situational awareness rather than data theft.
Executive priority
Prioritize this where drone detection supports security, safety, or regulated operations. Although exploitation is not reported in the provided sources, the vulnerability can undermine trust in Remote ID data and may affect response decisions during drone incidents.
Technical view
CVE-2023-31191 affects the adjacent channel suppression algorithm in DroneScout ds230 firmware versions 20211210-1627 through 20230329-1042. Adjacent radio traffic injection can cause real RID information to be dropped and crafted RID information to be emitted as JSON MQTT messages to an integrator-operated broker.
Likely exposure
Exposure is likely limited to environments using BlueMark DroneScout ds230 Remote ID receivers, especially where MQTT output feeds operational dashboards or security workflows. The attacker must be adjacent in radio terms, but the CVSS vector indicates low complexity, no privileges, and no user interaction.
Exploitation context
The bundle does not show active exploitation, and this CVE is not marked KEV. The described attack uses high-power spoofed Open Drone ID messages on selected channels to interfere with receiver output. This should be treated as a high-impact integrity and availability risk for Remote ID monitoring.
Researcher notes
Evidence is strongest for the affected firmware range, attack preconditions, and impact on MQTT output. The source bundle does not provide exploit status, a specific fixed version, or detailed vendor mitigation text, so remediation should be confirmed against BlueMark guidance.
Mitigation direction
- Inventory all DroneScout ds230 receivers and record firmware versions.
- Check BlueMark firmware history and vendor guidance for corrected firmware.
- Prioritize remediation for receivers feeding operational or security decisions.
- Treat affected receiver MQTT output as untrusted until remediated.
- Use independent validation sources for critical Remote ID decisions.
Validation and detection
- Confirm whether ds230 firmware is between 20211210-1627 and 20230329-1042.
- Identify MQTT brokers and applications consuming ds230 JSON messages.
- Verify whether BlueMark or the integrator has deployed updated firmware.
- Review operational logs for unexpected RID inconsistencies or missing real RID data.
- Document any business process that relies solely on ds230 Remote ID output.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-223: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-31191 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H2.85.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Omission of Security-relevant Information
Omission of Security-relevant Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.