CVE detail

CVE-2017-11580 — CVE-2017-11580

Published 2019-07-02 · Modified 2026-06-17 · Vendor blipcare · Product wi-fi_blood_pressure_monitor_firmware · Source nvd
MEDIUM
severity
CVSS-derived band
6.5
CVSS v3
0–10 scale
0.0143
EPSS probability
exploitation probability, 30d
71.0%
EPSS percentile
percentile vs all CVEs
NOT LISTED
CISA KEV
known exploited catalog

Description

Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the "Blip" open wireless connection provided by the device, if a large string is sent as a part of the HTTP request in any part of the HTTP headers, the device could become completely unresponsive. Presumably this happens as the memory footprint provided to this device is very small. According to the specs from Rezolt, the Wi-Fi module only has 256k of memory. As a result, an incorrect string copy operation using either memcpy, strcpy, or any of their other variants could result in filling up the memory space allocated to the function executing and this would result in memory corruption. To test the theory, one can modify the demo application provided by the

Remediation

No vendor-published fix data in our corpus for this CVE. Check the references below or the vendor's PSIRT / security advisories page.

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.