CVE-2025-11648
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-12

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-12
Last Modified
2026-04-29
Generated
2026-05-07
AI Q&A
2025-10-13
EPSS Evaluated
2026-05-05
NVD
CVE-2025-11648
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
furbo furbo_mini_firmware to 074 (inc)
furbo furbo_mini *
furbo furbo_360_dog_camera_firmware to 036 (inc)
furbo furbo_360_dog_camera *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in Tomofun Furbo 360 and Furbo Mini devices, specifically in an unknown function of the file TF_FQDN.json within the GATT Interface URL Handler component. It allows an attacker to perform server-side request forgery (SSRF) remotely. Exploiting this vulnerability is highly complex and difficult, but the exploit has been publicly disclosed and may be used.


How can this vulnerability impact me? :

The vulnerability can lead to server-side request forgery, which may allow an attacker to make unauthorized requests from the affected device to internal or external systems. This can result in unauthorized access, data exposure, or manipulation of information, potentially compromising confidentiality, integrity, and availability of data or services.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart