CVE-2017-11578

It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect to web management interface on a non-SSL connection using plain text HTTP protocol. The user uses the web management interface of the device to provide the user's Wi-Fi credentials so that the device can connect to it and have Internet access. This device acts as a Wireless Blood pressure monitor and is used to measure blood pressure levels of a person. This allows an attacker who is connected to the Blipcare's device wireless network to easily sniff these values using a MITM attack.

• CWE-200

• http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Blipcare_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Blipcare_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory

Published

Jul 2, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11572FontForge 20161012 is vulnerable to a heap-based buffer over…
• CVE-2017-11573FontForge 20161012 is vulnerable to a buffer over-read in Va…
• CVE-2017-11574FontForge 20161012 is vulnerable to a heap-based buffer over…
• CVE-2017-11575FontForge 20161012 is vulnerable to a buffer over-read in st…
• CVE-2017-11576FontForge 20161012 does not ensure a positive size in a weig…
• CVE-2017-11577FontForge 20161012 is vulnerable to a buffer over-read in ge…
• CVE-2017-11579In the most recent firmware for Blipcare, the device provide…
• CVE-2017-11580Blipcare Wifi blood pressure monitor BP700 10.1 devices allo…
• CVE-2017-11581dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin…
• CVE-2017-11582dayrui FineCms 5.0.9 has SQL Injection via the num parameter…
• CVE-2017-11583dayrui FineCms 5.0.9 has SQL Injection via the catid paramet…
• CVE-2017-11584dayrui FineCms 5.0.9 has SQL Injection via the field paramet…