PT-2025-41727 · Tomofun · Tomofun Furbo Mini+1

Calvin Star + 2 · Published 2025-10-12 · Updated 2025-10-12 · CVE-2025-11639

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074

Description A security issue exists in Tomofun Furbo 360 and Furbo Mini related to insecure storage of sensitive information. The issue is associated with the collect logs.sh file within the Debug Log S3 Bucket Handler component and involves an unknown function. Exploitation requires local access.

Recommendations Update Tomofun Furbo 360 to a version later than FB0035 FW 036 Update Tomofun Furbo Mini to a version later than MC0020 FW 074

Exploit

Fix

Information Disclosure

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-922

Related Identifiers

CVE-2025-11639

Affected Products

Tomofun Furbo 360

Tomofun Furbo Mini

References · 9

• 🔥 https://vuldb.com/?id.328050 · Exploit
• 🔥 https://vuldb.com/?submit.661876 · Exploit
• https://osv.dev/vulnerability/CVE-2025-11639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11639 · Security Note
• https://vuldb.com/?submit.661364 · Note
• https://t.me/CVEtracker/34718 · Telegram Post
• https://vuldb.com/?ctiid.328050 · Note
• https://twitter.com/CVEnew/status/1977431637756453000 · Twitter Post
• https://t.me/cveNotify/138389 · Telegram Post