CVE-2017-11580 in BP700
Summary
by MITRE
Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the "Blip" open wireless connection provided by the device, if a large string is sent as a part of the HTTP request in any part of the HTTP headers, the device could become completely unresponsive. Presumably this happens as the memory footprint provided to this device is very small. According to the specs from Rezolt, the Wi-Fi module only has 256k of memory. As a result, an incorrect string copy operation using either memcpy, strcpy, or any of their other variants could result in filling up the memory space allocated to the function executing and this would result in memory corruption. To test the theory, one can modify the demo application provided by the Cypress WICED SDK and introduce an incorrect "memcpy" operation and use the compiled application on the evaluation board provided by Cypress semiconductors with exactly the same Wi-Fi SOC. The results were identical where the device would completely stop responding to any of the ping or web requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2023
The CVE-2017-11580 vulnerability affects Blipcare Wifi blood pressure monitor BP700 10.1 devices that operate with extremely limited memory resources, specifically utilizing a Wi-Fi module with only 256k of memory as documented by Rezolt specifications. This constrained memory environment creates a critical security landscape where buffer overflow conditions can readily occur due to the minimal memory footprint allocated to network processing functions. The vulnerability manifests when devices connect to the "Blip" open wireless network and receive HTTP requests containing excessively long strings within HTTP headers, leading to complete device unresponsiveness and denial of service conditions.
The technical flaw stems from improper memory management practices within the device's network stack implementation, specifically involving incorrect string copy operations using memcpy, strcpy, or similar functions. These operations exploit the device's limited memory allocation by exceeding the available buffer space, causing memory corruption that fundamentally disrupts the device's operational capabilities. The vulnerability represents a classic buffer overflow scenario where the device's small memory footprint of 256k creates an environment where even minor memory management errors can result in catastrophic system failure. The issue is particularly concerning because it operates at the HTTP protocol level, making exploitation relatively straightforward through malformed header values.
The operational impact of this vulnerability extends beyond simple denial of service to represent a potential security risk for medical devices that require continuous operation. When the memory corruption occurs, the device becomes completely unresponsive to both ping requests and web-based management interfaces, effectively rendering it non-functional for its intended medical monitoring purposes. This situation can be particularly dangerous in healthcare environments where continuous patient monitoring is essential, as the device may fail to provide critical blood pressure readings during periods of need. The vulnerability demonstrates how resource-constrained embedded systems can become particularly susceptible to memory-related attacks that would be less severe on systems with abundant memory resources.
The exploitation methodology for this vulnerability aligns with common embedded system attack patterns and can be validated through the Cypress WICED SDK demonstration approach. Security researchers can replicate the exact conditions by modifying the provided demo application and implementing incorrect memcpy operations on evaluation boards with identical Wi-Fi SoC configurations, confirming that the device behavior remains consistent regardless of the specific implementation details. This validation process demonstrates the vulnerability's reproducibility and confirms that the issue exists at the fundamental level of memory management within the device's network processing stack. The vulnerability maps directly to CWE-121 and CWE-122 categories related to buffer overflow conditions, and represents a clear example of how ATT&CK technique T1499.004 (Network Denial of Service) can be achieved through memory corruption in IoT devices. Mitigation strategies should focus on implementing proper bounds checking and memory validation mechanisms within the device firmware, along with network-level protections that can filter or truncate overly long HTTP header values to prevent exploitation of this memory corruption vulnerability.