PT-2025-41734 · Tomofun · Tomofun Furbo Mini+1

Calvin Star + 3 · Published 2025-10-12 · Updated 2025-10-12 · CVE-2025-11646

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074

Description A flaw exists in Tomofun Furbo 360 and Furbo Mini due to improper access controls within the GATT Service component. This issue can be exploited from the local network. The exploit is publicly available.

Recommendations Update Tomofun Furbo 360 to a version later than FB0035 FW 036. Update Tomofun Furbo Mini to a version later than MC0020 FW 074.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-11646

Affected Products

Tomofun Furbo 360

Tomofun Furbo Mini

References · 9

• 🔥 https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Information-Disclosure-P2PUUID.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-11646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11646 · Security Note
• https://twitter.com/CVEnew/status/1977486283120218564 · Twitter Post
• https://t.me/cveNotify/138396 · Telegram Post
• https://vuldb.com/?submit.661900 · Note
• https://t.me/CVEtracker/34725 · Telegram Post
• https://vuldb.com/?id.328057 · Note
• https://vuldb.com/?ctiid.328057 · Note