PT-2025-41737 · Tomofun · Tomofun Furbo Mini+1

Calvin Star + 3 · Published 2025-10-12 · Updated 2025-10-28 · CVE-2025-11649

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074

Description A security flaw exists in Tomofun Furbo 360 and Furbo Mini devices. The issue involves an unknown function within the Root Account Handler component, which, when manipulated, exposes a hard-coded password. An attacker with local access can exploit this flaw, potentially gaining unauthorized control over the device. The exploit has been made public. The complexity of the attack is considered high, and exploitability is described as difficult.

Recommendations For Tomofun Furbo 360 versions prior to FB0035 FW 036, update the firmware to version FB0035 FW 036 or later. For Tomofun Furbo Mini versions prior to MC0020 FW 074, update the firmware to version MC0020 FW 074 or later.

Exploit

Fix

Weakness Enumeration

CWE-255

CWE-259

Related Identifiers

CVE-2025-11649

Affected Products

Tomofun Furbo 360

Tomofun Furbo Mini

References · 12

• 🔥 https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-11649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11649 · Security Note
• https://twitter.com/CVEnew/status/1977507201720680681 · Twitter Post
• https://t.me/CVEtracker/34728 · Telegram Post
• https://twitter.com/CveTodo/status/1977516683146260953 · Twitter Post
• https://vuldb.com/?id.328060 · Note
• https://twitter.com/cracbot/status/1979140374217076897 · Twitter Post
• https://vuldb.com/?submit.662769 · Note
• https://t.me/cveNotify/140594 · Telegram Post
• https://t.me/cveNotify/138399 · Telegram Post
• https://vuldb.com/?ctiid.328060 · Note