PT-2025-41738 · Tomofun · Furbo Mini+1

Calvin Star + 3 · Published 2025-10-12 · Updated 2025-12-23 · CVE-2025-11650

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074

Description A weakness exists in Tomofun Furbo 360 and Furbo Mini related to password handling. Manipulation of the /etc/shadow file, through an unknown function, can lead to the use of weak hash values. The attack can be performed on the physical device and requires a high level of complexity, though exploitability is considered difficult. The exploit has been publicly disclosed.

Recommendations Update Furbo 360 to a version later than FB0035 FW 036. Update Furbo Mini to a version later than MC0020 FW 074.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-328

Related Identifiers

CVE-2025-11650

Affected Products

Furbo 360

Furbo Mini

References · 11

• 🔥 https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11650 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11650 · Vendor Advisory
• https://twitter.com/CVEnew/status/2003567317511295413 · Twitter Post
• https://t.me/CVEtracker/34729 · Telegram Post
• https://vuldb.com/?ctiid.328061 · Note
• https://t.me/cveNotify/138400 · Telegram Post
• https://t.me/cveNotify/140595 · Telegram Post
• https://vuldb.com/?submit.662771 · Note
• https://vuldb.com/?id.328061 · Note
• https://twitter.com/VulmonFeeds/status/1977518865803260120 · Twitter Post