PT-2025-41728 · Tomofun · Tomofun Furbo Mini+1

Calvin Star + 2 · Published 2025-10-12 · Updated 2025-10-12 · CVE-2025-11640

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074

Description A security issue exists in Tomofun Furbo 360 and Furbo Mini related to the Bluetooth Low Energy component. The issue allows for the cleartext transmission of sensitive information. Exploitation requires access to the local network and is considered highly complex with a difficult exploitability.

Recommendations Tomofun Furbo 360 versions prior to FB0035 FW 036 should be updated to FB0035 FW 036 or later. Tomofun Furbo Mini versions prior to MC0020 FW 074 should be updated to MC0020 FW 074 or later.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-310

CWE-319

Related Identifiers

CVE-2025-11640

Affected Products

Tomofun Furbo 360

Tomofun Furbo Mini

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11640 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11640 · Vendor Advisory
• https://t.me/cveNotify/138390 · Telegram Post
• https://vuldb.com/?ctiid.328051 · Note
• https://vuldb.com/?submit.661374 · Note
• https://t.me/CVEtracker/34719 · Telegram Post
• https://vuldb.com/?id.328051 · Note