CVE-2017-11578

Vulnerability

The Blipcare Wireless Blood Pressure Monitor, in the most recent firmware at the time of discovery, exposes its web management interface over unencrypted HTTP. This interface is used to configure the device's Wi-Fi connection by supplying the user's network credentials. The use of plaintext HTTP allows any network traffic to be intercepted. Affected versions include the firmware analyzed in the research, as documented in the advisory [1].

Exploitation

An attacker who is connected to the same wireless network as the Blipcare device can perform a man-in-the-middle (MITM) attack. By positioning themselves between the user and the device's web interface, they can sniff the HTTP traffic and capture the Wi-Fi credentials as they are transmitted in cleartext. No authentication is required beyond network proximity [1].

Impact

Successful exploitation allows the attacker to obtain the user's Wi-Fi network credentials. With these credentials, the attacker can gain unauthorized access to the victim's Wi-Fi network, potentially compromising other devices and data on that network. The confidentiality of the Wi-Fi credentials is directly compromised [1].

Mitigation

As of the publication date (2019-07-02), no official firmware update or patch has been released by Blipcare to address this vulnerability. Users should avoid using the web management interface over untrusted networks and consider using a separate, isolated network for IoT devices if possible. The device remains unpatched as per the available reference [1].