BaseFortify

Publication date: 2025-10-12

Last updated on: 2026-04-29

Assigner: VulDB

Description

A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the argument DeviceToken causes information disclosure. The attack is only possible within the local network. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-12

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2025-10-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11647

Affected Vendors & Products

Vendor	Product	Version / Range
furbo	furbo_mini_firmware	to 074 (inc)
furbo	furbo_mini	*
furbo	furbo_360_dog_camera_firmware	to 036 (inc)
furbo	furbo_360_dog_camera	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in Tomofun Furbo 360 and Furbo Mini devices related to the processing of the GATT Service component. Specifically, manipulation of the DeviceToken argument can lead to information disclosure. The attack can only be performed within the local network and requires a high degree of complexity, making exploitation difficult. The affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.

Impact Analysis

The vulnerability can lead to information disclosure if exploited. However, exploitation is difficult and limited to attackers within the local network. This means sensitive information from the affected devices could be exposed to unauthorized local attackers.

Hi! I’m here to help you understand CVE-2025-11647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70