Missing TLS (HTTPS) certificate validation during firmware update in DroneScout ds230 Remote ID receiver from BlueMark Innovations

Vulnerability

DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure. The firmware update process ignores and does not check the validity of the TLS certificate of the HTTPS endpoint from which the firmware update package (.tar.bz2 file) is downloaded. This affects DroneScout ds230 firmware versions from 20211210-1627 through 20230329-1042 [1][2].

Exploitation

An attacker with the ability to perform a Man-in-the-Middle attack (e.g., via DNS poisoning, ARP poisoning, or control of a node on the network route) can trick the DroneScout ds230 into downloading a crafted malicious firmware update. No prior authentication or user interaction is required beyond positioning themselves in the network path [2].

Impact

Successful exploitation allows the attacker to install arbitrary files (e.g., executables and configuration) and gain administrative (root) privileges on the underlying Linux operating system of the DroneScout ds230 [2].

Mitigation

Update the DroneScout ds230 firmware to a version newer than 20230329-1042. The firmware history indicates that later versions, such as 20250624-1146 and newer, include security improvements [1]. [2] confirms that upgrading to a version beyond the affected range resolves the issue.