CVE-2017-11578

MEDIUM

Blipcare Wi-Fi Blood Pressure Monitor < bp700_10.1 - Sensitive Information Exposure via Plaintext HTTP

Title source: llm
STIX 2.1

Description

It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect to web management interface on a non-SSL connection using plain text HTTP protocol. The user uses the web management interface of the device to provide the user's Wi-Fi credentials so that the device can connect to it and have Internet access. This device acts as a Wireless Blood pressure monitor and is used to measure blood pressure levels of a person. This allows an attacker who is connected to the Blipcare's device wireless network to easily sniff these values using a MITM attack.

References (3)

Core 3
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Jun/8

Scores

CVSS v3 5.9
EPSS 0.0205
EPSS Percentile 78.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
blipcare/wi-fi_blood_pressure_monitor_firmware < bp700_10.1
Published Jul 02, 2019
Tracked Since Feb 18, 2026