CVE-2025-11633
BaseFortify
Publication date: 2025-10-12
Last updated on: 2025-10-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| furbo | furbo_mini_firmware | to 074 (inc) |
| furbo | furbo_mini | * |
| furbo | furbo_360_dog_camera_firmware | to 036 (inc) |
| furbo | furbo_360_dog_camera | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11633 is a vulnerability in Tomofun Furbo 360 and Furbo Mini devices caused by improper certificate validation in their HTTP Traffic Handler component. The devices use curl with the "-k" option, which disables certificate verification, allowing an attacker positioned upstream to perform a man-in-the-middle attack. This enables the attacker to impersonate the server and intercept HTTPS traffic, including sensitive data such as user account IDs, device IDs, and configurations. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a remote attacker to intercept and decrypt HTTPS traffic between your device and its server. The attacker can access sensitive information like user account IDs, device IDs, and configurations, which can be used to launch more targeted and sophisticated attacks against your device or user account. The integrity of your device's communications is compromised, potentially leading to unauthorized data exposure. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTPS traffic from affected Tomofun Furbo 360 and Furbo Mini devices for signs of man-in-the-middle attacks or improper certificate validation. Since the devices use curl with the "-k" option (which disables certificate verification), you can look for HTTPS requests from these devices that do not properly validate certificates. Network traffic analysis tools like Wireshark can be used to inspect TLS handshakes for anomalies. Additionally, checking device firmware versions to see if they are up to Furbo 360 FB0035_FW_036 or Furbo Mini MC0020_FW_074 can help identify vulnerable devices. Specific commands are not provided in the resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing affected Tomofun Furbo 360 and Furbo Mini devices running vulnerable firmware versions (up to FB0035_FW_036 for Furbo 360 and up to MC0020_FW_074 for Furbo Mini) with alternatives, as no known countermeasures or patches are currently available. Avoid using these devices on sensitive networks where interception risks are high. Monitor network traffic for suspicious activity and consider isolating these devices to limit exposure. [2]