CVE-2025-11640
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-12

Last updated on: 2025-10-29

Assigner: VulDB

Description
A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for this attack. Attacks of this nature are highly complex. The exploitability is reported as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-12
Last Modified
2025-10-29
Generated
2026-05-07
AI Q&A
2025-10-12
EPSS Evaluated
2026-05-05
NVD
CVE-2025-11640
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
furbo furbo_mini_firmware to 074 (inc)
furbo furbo_mini *
furbo furbo_360_dog_camera_firmware to 036 (inc)
furbo furbo_360_dog_camera *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-310 Cryptographic Issues
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability affects Tomofun Furbo 360 and Furbo Mini devices in their Bluetooth Low Energy component. It allows sensitive information to be transmitted in cleartext, meaning the data is not encrypted and can be intercepted by someone with access to the local network. Exploiting this vulnerability is highly complex and difficult.


How can this vulnerability impact me? :

The vulnerability can lead to exposure of sensitive information transmitted by the affected devices over Bluetooth Low Energy. An attacker with access to the local network could intercept this information due to the cleartext transmission. However, the attack is difficult to execute and requires local network access.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart