CVE-2025-11641
BaseFortify
Publication date: 2025-10-12
Last updated on: 2025-10-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| furbo | furbo_mini_firmware | to 074 (inc) |
| furbo | furbo_mini | * |
| furbo | furbo_360_dog_camera_firmware | to 036 (inc) |
| furbo | furbo_360_dog_camera | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11641 is an access control vulnerability in Tomofun Furbo 360 and Furbo Mini devices affecting the Trial Restriction Handler component. It allows an attacker with physical access to the device to bypass trial restrictions by manipulating the device's MAC address, which resets the 30-day premium trial period repeatedly. This results in unauthorized unlimited access to premium features without proper authorization. Exploitation is difficult and requires physical access, with no authentication needed. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users with physical access to your Tomofun Furbo 360 or Furbo Mini device to bypass trial restrictions and gain unlimited access to premium features without paying or proper authorization. This compromises the device's intended usage controls and may affect the confidentiality, integrity, and availability of the device's features. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability requires physical access to the device and involves manipulation of the device's MAC address to bypass trial restrictions. Detection on a network or system via commands is not feasible because the exploit does not rely on network activity or remote access. There are no known public exploits or detection commands available. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or mitigations exist for this vulnerability. The recommended immediate step is to replace affected devices with alternative products. Since the vendor has not responded and no patches are available, physical security to prevent unauthorized access is also advised. [1]