PT-2025-41731 · Tomofun · Furbo Mini+1

Calvin Star + 2 · Published 2025-10-12 · Updated 2025-11-10 · CVE-2025-11643

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074

Description A security flaw exists in Tomofun Furbo 360 and Furbo Mini devices. The issue involves manipulation of the file /squashfs-root/furbo img within the MQTT Client Certificate component, leading to the exposure of hard-coded credentials. This attack can be initiated remotely and is considered to have high complexity, though exploitation is difficult.

Recommendations Update Furbo 360 to a version later than FB0035 FW 036. Update Furbo Mini to a version later than MC0020 FW 074.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-338

CWE-798

Related Identifiers

BDU:2026-00038

CVE-2025-11643

Affected Products

Furbo 360

Furbo Mini

References · 12

• 🔥 https://vuldb.com/?submit.661875 · Exploit
• https://bdu.fstec.ru/vul/2026-00038 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11643 · Security Note
• https://t.me/CVEtracker/34722 · Telegram Post
• https://vuldb.com/?ctiid.328054 · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-45604 · Note
• https://vuldb.com/?id.328054 · Note
• https://twitter.com/CVEnew/status/1977461911332471147 · Twitter Post
• https://t.me/cveNotify/138393 · Telegram Post
• https://certvde.com/en/advisories/VDE-2025-086 · Note
• https://jumo.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-086.json · Note