Executive Summary

CVE-2025-11635 is a resource consumption vulnerability in the Tomofun Furbo 360 device (firmware up to FB0035_FW_036). It occurs in the File Upload component where an authenticated attacker can upload or force the device to download excessively large files without size restrictions. This causes the device to consume all available disk space, leading to a Denial of Service (DoS) condition that makes the device inoperable. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) on the affected Tomofun Furbo 360 device. An attacker can remotely exploit the flaw to exhaust the device's storage resources, rendering it unavailable and inoperable. This affects the device's availability but does not compromise confidentiality or integrity. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves resource consumption caused by uploading excessively large files to the Tomofun Furbo 360 device. Detection could involve monitoring the device's disk usage and network traffic for unusually large file uploads or spikes in resource consumption. Since the attack requires authentication and involves file uploads, commands to check disk space (e.g., 'df -h' on the device if accessible) and network monitoring tools to detect large file transfers could be useful. However, no specific detection commands or signatures are publicly available. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

No official mitigation or vendor guidance is available as the vendor did not respond to the disclosure. Immediate steps include monitoring and limiting file upload sizes if possible, restricting authenticated access to trusted users only, and considering replacing the affected Tomofun Furbo 360 device with an alternative product to avoid exploitation. Since the vulnerability leads to denial of service via resource exhaustion, preventing large file uploads or limiting resource usage is recommended. [2]

Useful 0 Not Useful 0