CVE-2025-11649
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-12

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing manipulation results in use of hard-coded password. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-12
Last Modified
2026-04-29
Generated
2026-05-07
AI Q&A
2025-10-13
EPSS Evaluated
2026-05-05
NVD
CVE-2025-11649
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
furbo furbo_mini_firmware to 074 (inc)
furbo furbo_mini *
furbo furbo_360_dog_camera_firmware to 036 (inc)
furbo furbo_360_dog_camera *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
CWE-255
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in Tomofun Furbo 360 and Furbo Mini devices within an unknown function of the Root Account Handler component. It involves the use of a hard-coded password, which can be exploited by an attacker with local access. The attack is complex and difficult to execute, but the exploit has been made public.


How can this vulnerability impact me? :

If exploited, this vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected device. An attacker with local access could use the hard-coded password to gain unauthorized root-level access, potentially controlling the device and accessing sensitive information.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart