It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• blipcare wi-fi blood pressure monitor firmwareup to bp700_10.1 inclusive

Other highest-scoring records for the same primary product.

• CVE-2017-11579In the most recent firmware for Blipcare, the device provides an open Wireless network called "Blip" for communicating with the device.
  28Monitor
• CVE-2017-11580Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service.
  26Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.