PT-2025-41736 · Tomofun · Furbo Mini+1

Calvin Star + 3 · Published 2025-10-12 · Updated 2025-10-28 · CVE-2025-11648

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074

Description A server-side request forgery condition exists in Tomofun Furbo 360 and Furbo Mini due to manipulation of the file TF FQDN.json within the GATT Interface URL Handler component. The attack can be performed remotely and is considered highly complex, with a difficult exploitability. The exploit has been publicly disclosed.

Recommendations Update Tomofun Furbo 360 to version FB0035 FW 036 or later. Update Tomofun Furbo Mini to version MC0020 FW 074 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-11648

Affected Products

Furbo 360

Furbo Mini

References · 12

• 🔥 https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-11648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11648 · Security Note
• https://vuldb.com/?submit.662768 · Note
• https://t.me/cveNotify/139360 · Telegram Post
• https://t.me/cveNotify/140593 · Telegram Post
• https://t.me/CVEtracker/34727 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1977500932448350382 · Twitter Post
• https://vuldb.com/?id.328059 · Note
• https://vuldb.com/?ctiid.328059 · Note
• https://t.me/cveNotify/138398 · Telegram Post
• https://twitter.com/CVEnew/status/1977502335573102739 · Twitter Post