CVE-2025-11646
BaseFortify
Publication date: 2025-10-12
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| furbo | furbo_mini_firmware | to 074 (inc) |
| furbo | furbo_mini | * |
| furbo | furbo_360_dog_camera_firmware | to 036 (inc) |
| furbo | furbo_360_dog_camera | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Tomofun Furbo 360 and Furbo Mini devices, specifically in the GATT Service component. It allows improper access controls, meaning unauthorized users on the local network could potentially exploit the device. The attack requires local network access and the affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to the affected devices from within the local network. This could result in exposure of sensitive information or unauthorized control of the device, potentially compromising privacy and security.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your Tomofun Furbo 360 and Furbo Mini devices are not running affected firmware versions (Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074). Restrict access to the local network where these devices operate, as the attack can only be performed from the local network. Monitor for any firmware updates from the vendor, although no response has been received yet. Consider isolating these devices on a separate network segment to limit exposure.