CVSS 3.0
5.9 mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2017-11578
Medium (5.9) in blipcare wi-fi blood pressure monitor firmware. EPSS 2.0% chance of exploitation in the next 30 days.
It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect to web management interface on a non-SSL connection using plain text HTTP protocol. The user uses the web management interface of the device to provide the user's Wi-Fi credentials so that the device can connect to it and have Internet access. This device acts as a Wireless Blood pressure monitor and is used to measure blood pressure levels of a person. This allows an attacker who is connected to the Blipcare's device wireless network to easily sniff these values using a MITM attack.
Severity
- EPSS
- 2.0% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- blipcare:wi-fi_blood_pressure_monitor_firmware
References
- http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.html
- https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Blipcare_sec_issues.pdf
- https://seclists.org/bugtraq/2019/Jun/8
- http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.html
- https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Blipcare_sec_issues.pdf