PT-2025-41735 · Tomofun · Furbo Mini+1

Calvin Star + 3 · Published 2025-10-12 · Updated 2025-10-28 · CVE-2025-11647

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074

Description A flaw exists in Tomofun Furbo 360 and Furbo Mini related to the processing of the GATT Service component. Manipulation of the DeviceToken argument can lead to information disclosure. The attack is limited to the local network and requires a high degree of complexity, making exploitability difficult. The exploit has been published.

Recommendations Update Furbo 360 to a version later than FB0035 FW 036. Update Furbo Mini to a version later than MC0020 FW 074.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2025-11647

Affected Products

Furbo 360

Furbo Mini

References · 11

• 🔥 https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Information-Disclosure-DeviceToken.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11647 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11647 · Vendor Advisory
• https://t.me/cveNotify/140592 · Telegram Post
• https://vuldb.com/?id.328058 · Note
• https://vuldb.com/?ctiid.328058 · Note
• https://vuldb.com/?submit.662767 · Note
• https://t.me/CVEtracker/34726 · Telegram Post
• https://t.me/cveNotify/138397 · Telegram Post
• https://t.me/cveNotify/139339 · Telegram Post
• https://twitter.com/CVEnew/status/1977488648351445130 · Twitter Post