CVE-2025-11634
BaseFortify
Publication date: 2025-10-12
Last updated on: 2025-10-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| furbo | furbo_mini_firmware | to 074 (inc) |
| furbo | furbo_mini | * |
| furbo | furbo_360_dog_camera_firmware | to 036 (inc) |
| furbo | furbo_360_dog_camera | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Tomofun Furbo 360 and Furbo Mini devices through their UART interface. An attacker with physical access to the UART interface can extract sensitive information such as Firmware URL, SecretKey, DeviceToken, and DeviceId from log files. Using this information, the attacker can retrieve and decrypt the device's firmware, impersonate the device, and upload malicious files to a debug server, potentially compromising the device. [1, 2]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive device information, allowing an attacker with physical access to decrypt firmware and impersonate the device. This can result in malicious firmware uploads and device compromise. However, exploitation requires physical access and no remote attack is possible. The impact is limited to confidentiality, with no effect on integrity or availability. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability requires physical access to the UART interface of the affected Tomofun Furbo 360 and Furbo Mini devices. Detection involves physically connecting to the UART interface and inspecting log files for sensitive information such as Firmware URL, SecretKey, DeviceToken, and DeviceId. There are no known remote detection methods or specific commands provided. Since the attack is local and hardware-based, network detection is not applicable. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting physical access to the affected devices to prevent exploitation via the UART interface. Since no vendor response or patches are available and no known mitigations exist, it is recommended to consider replacing affected devices with alternatives. Monitoring physical security and device usage is critical. [2]